Extracted

• • Target

    setup.msi

  • Size

    57.9MB

  • MD5

    0a208aa5e80a1e3a42fa60331f14907b

  • SHA1

    418259c831d919bf0bc9f5a46eaa6b803ab1b3bf

  • SHA256

    e218b230e70d84ca9246961436261d6435095b2c3e0df1544e5de0ecd6bd4094

  • SHA512

    5bbad3bbe549032505fd82462bd279e6f7a5ba963eb0e6234a9150c76d3ea543faec9995dac5a42b320d1f0bf2b2fa95e11b5dfd366a9dad6248b99e87c93a06

  • SSDEEP

    1572864:BrQVmrjV7eIvnOTZscak5wE7nTZh8MoF:9TRc7XzVC5

  Score

  10^/10

  discoveryexecutionpersistenceprivilege_escalationlummastealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2