Extracted

• • Target

    MediPeel.exe

  • Size

    10.7MB

  • MD5

    ebb28d3da6ea29cec25910328415f994

  • SHA1

    a178aaa66b50fb03e3db39902b31400b7088f2b1

  • SHA256

    2a875c4f05a84aa5fa139d23e0b51b7cd2047c06a35d051ebd0891bd11f3a721

  • SHA512

    a6073636b21f19e69a7f0e9b1ef201867fbad9a14f10f1d2c8b63cc3b2f6fdf3b3954be1955b37c8034ff52e048fe489f27553aaf28401bc93a317753f02c09a

  • SSDEEP

    196608:Q4xFLbxtbJBdZaK31/aGdJXOLBZIy+fjfKCGqlQGDM427lZCcxxi6VTDqQ7poZQ:QeVbxH93Fa0JXDysQR57lZnxxi+TOQ7z

  Score

  10^/10

  lummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2