Extracted

• • Target

    ee27463e66262cb5be6a087222573b30516fa70b911e359e469e7cc03427e38c.ps1

  • Size

    51.3MB

  • MD5

    d71c930452ae704ac29ec1e5e4586fe3

  • SHA1

    8651de4941bb4660fb3b3ae9442a8f6fcda2d51f

  • SHA256

    ee27463e66262cb5be6a087222573b30516fa70b911e359e469e7cc03427e38c

  • SHA512

    e665f1de54c422f8947e59fa8ebf8136c3157c1686e5e153904d97f1d7a904e2d10f611359b2808d0ceb0e40862fdf0d33c1ad4f2f5960b2a60294378e485466

  • SSDEEP

    49152:DXyMg7Tu4U0/N/sNe3nxbrLU9Y+HiKzc06HSr5nNALrfJ+Wa93QJkHVgTETwWfc/:s

  Score

  10^/10

  executionlummadiscoverypersistencestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2