Extracted

Extracted

• • Target

    Install.exe

  • Size

    459KB

  • MD5

    ad38d43c1eca47ac35ac2139b87379ac

  • SHA1

    86cbcc824c314d83a1e50c9a9c5e720a3a94944d

  • SHA256

    8bbceb5526f4c4cf26a60c0094e8ebbf7811cc54500bb86e07de84b64d5c223c

  • SHA512

    7fd4755a2111064a78fd2d9cefa67773bf7fb190e389aac5b460e9f4d82f0302524436989a86fc6b525208c81726a3830ad5ba447763152d5ca964c204c78e28

  • SSDEEP

    12288:vV4fznmsrVQRW8D8XpjHCpJ+IYCNIqI2070iailr7v:vuyCFXpc+IYvqager7v

  Score

  10^/10

  lummadefense_evasiondiscoverypersistencephishingprivilege_escalationstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Downloads MZ/PE file

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2