Extracted

• • Target

    2024-11-19_5721a27e3adc8f44a3dd296fad7ed75a_cobalt-strike_megazord

  • Size

    14.4MB

  • MD5

    5721a27e3adc8f44a3dd296fad7ed75a

  • SHA1

    70dc06923c572f94a7ec14e93e8bd712cb131792

  • SHA256

    38d32f6f7d8a60e66ccddc64f685e089efb8a7ace2e1129a4b424eb9e6869e78

  • SHA512

    80c6d8f6138e2d4f839c806aceaa8be36f0026c500ffd7e5823248bda3b969dd04358fccba4d3c9912a04d46c1fc32052af19a34f0d27dde7465aea5650b5a84

  • SSDEEP

    196608:ZZdyirGA46KGiTjG1XG8Dp6X1OrKpluJQ/NBqs:ZrRGb1Tx8Dk/plua

  Score

  10^/10

  executionlummadiscoverystealerupx

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2