Extracted

• • Target

    Fiddler Triage Pyinstaller shit.zip

  • Size

    15.1MB

  • MD5

    24397d2e33ee125a1b72f3311a4275ff

  • SHA1

    8909595ec2010cf7fdd434d468a3740713b03322

  • SHA256

    7c34a70cbe324be93f2302086912c6438ffc74e6389a5f97d26c99ec411ebf38

  • SHA512

    a42916702ae456518271b7186f190583b6ff5507d70e52927d409b8080e029c9b3915c95251439528f6f7e14ec1831991fc9837fdc9df7a9cf4ebd76042a12e8

  • SSDEEP

    393216:JAn4eax3f8esk3rHAebz4jcIUmBJ27om2YgwMj8tFQgf9dATY:Js4ea3faAbiH27sYg9jGFQgnb

  Score

  10^/10

  lummadiscoveryevasionpersistenceprivilege_escalationspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Checks for common network interception software

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1