Extracted

• • Target

    https://cdn.discordapp.com/attachments/1313969251027128395/1317947051119743006/Void-Activator.exe?ex=67784457&is=6776f2d7&hm=f6d5e98cc3b69545e18a8b8b1aade95386350d8082702365e8e58134c47d7d18&

  Score

  10^/10

  lummanjratdiscoveryevasionpersistenceprivilege_escalationstealertrojan

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1