Extracted

Extracted

• • Target

    c19ce82f559dc54abd192e1c6f274b0078dcce06cd648ca4e97ba24609a6758e

  • Size

    23KB

  • MD5

    a97060894388dce333afe90503710c02

  • SHA1

    af7e16e99b79589f4690423f82502c5d21ed18fa

  • SHA256

    c19ce82f559dc54abd192e1c6f274b0078dcce06cd648ca4e97ba24609a6758e

  • SHA512

    459c87943790ccd5796a2fb3cd28b364adaa3735987bae962b266c926c47a7c5b82bdf28044f000dae8c353dfafc0200414a91440502f49a460a3d17654f3bc9

  • SSDEEP

    384:R5iDic/cOBkvPCq5/DYBEiiLWp0JNS/eqUMCaJFRmb50Y6MZNjihzQnHp0yVN8:2cTTS6MCyKb5/TJl8

  Score

  10^/10

  discoveryexecutionlummastealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2