Extracted

Extracted

• • Target

    7loader.exe

  • Size

    187.8MB

  • MD5

    f787203462958c73924fd508882190f5

  • SHA1

    07515c0447318c7b20e00c314500f0ad5d92b4e6

  • SHA256

    5ddc6c405538e9537a8076380e7a6664b5cf5c76c43b7dba242b266efdc1dd76

  • SHA512

    b425b8024a8b04e3d94a9657dd4462a45ad111f61817079e59fdefd6f398d6862f72b6a17bc4bf7420ec303053943f2a5b5af662fd679a4266f068953a4bcf03

  • SSDEEP

    192:O3uyjqT9RtHDRATYRlVYjXWZXYweJEQ4OWVPcc:Oe2m92TYRlVYjXWZXYYThV0

  Score

  10^/10

  lummadiscoveryexecutionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1