Extracted

Extracted

• • Target

    2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd.msi

  • Size

    54.5MB

  • MD5

    2d6151dbbbb50c077564ef7ffc971a4e

  • SHA1

    b67ec6dd683f5f8b12d52aa79aeee9a498380589

  • SHA256

    2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd

  • SHA512

    22a30787cf820da489ed59b8f6401b1282b923a66f796211c2300f1864f4f10bee01d24133bfcb35975695f32273796cacdef03d726345c7a12cfb8ce6509979

  • SSDEEP

    1572864:0p+Ty2SfWnHDk8FjVbfzPTq4h+RZYoFczfDiQPU8azMCAJ:h/0WnHDkkjBPTq4kYoFefTPU8awCm

  Score

  10^/10

  discoverypersistenceprivilege_escalationlummaexecutionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2