Extracted

• • Target

    channels4_profile.jpg

  • Size

    99KB

  • MD5

    ccca283f7172636af73e58bd5687cd7f

  • SHA1

    5cdfdcc7837e3d3a65d2b57cbdb619b598a19ad3

  • SHA256

    f32ebd12ae2f6ed4eaf7b8dd1413208103859549f121f9ea6244bce561807859

  • SHA512

    3aa2b434544b3c18a46bd232c61ef453e34685fc9f2451b725a2d3884ea79ace084bec1b8d9452c8a2f84ec9bc1df301d195b57e2736af16ba34adfec8911267

  • SSDEEP

    3072:1PH6X3eMajV+wVaoiMvxWA80kzKvgzPYR2no:1P6nbwV+c3WA80o5zP4

  Score

  10^/10

  lummadefense_evasiondiscoveryevasionpersistenceprivilege_escalationstealertrojan

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1