Extracted

• • Target

    Setup.exe

  • Size

    159KB

  • MD5

    959b592e44f2c0056956f5bbe14f6cb2

  • SHA1

    8db30e0a13c5b3d8580c948df786c6061f84f6db

  • SHA256

    2483c1ffe51092f0edd13f80f34f8a6df77cb52c471c88497d01dfa38b8b19ef

  • SHA512

    05530130692befa2c9c5bf5d3515097c0e4225f3e752438a2dc5b4d6e868485009481c5455ff854e6ca7fcece7f5214de5b6fd5bdd002caee7958af545c3063d

  • SSDEEP

    3072:oahKyd2n31cu5GWp1icKAArDZz4N9GhbkrNEk180T:oahOtp0yN90QEdY

  Score

  10^/10

  lummadiscoveryexecutionpersistencestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1