Extracted

• • Target

    this-extremely-veiny-sweet-potato-v0-bwpyw3iorv791-907968965.jpg

  • Size

    996KB

  • MD5

    58dbc46aed78c167222189532eeaf21b

  • SHA1

    a765c301397803688edb5d4a72e9029258cbffbc

  • SHA256

    fcdb8bdc6daad77bf3da76a49bce0536aef6ea50ed31da18119e7a2e465b070b

  • SHA512

    48c551dea1e8b664f75f6604373586ccc6ec94cf00c537908d9a651e2aa13021d1c136a869a97d2ad291794c10933e8ff413f286e5e8c4c7cc3ba43a627bcc24

  • SSDEEP

    24576:371RwxxwhcTVdwWINu2LjA6nkr9AGTLiMVXEaGN:3h+xSG5/2Q6nWniGXEJ

  Score

  10^/10

  lummadiscoverymotwphishingstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Downloads MZ/PE file

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Enumerates processes with tasklist

    discovery

  • Probable phishing domain

  behavioral1