Extracted

• • Target

    Software.zip

  • Size

    908KB

  • MD5

    6f676d2be92f94716a4be2b2b5f6392d

  • SHA1

    2e9a27380b2ecd17729ba0b61bbd35d26952a3f7

  • SHA256

    aefc0d264a6726fbbcfbb68385412b83d9928f0527813c543cb4f90d4920e419

  • SHA512

    2b0911894b54245f9f9ddee3a2f1a06d9066031d0aef6f52baa0addcb165f42d2d0627235bcc6f79f29b144960357cbdbb2b43dccbab1a849551773c3cbbd788

  • SSDEEP

    12288:5TyZHcK0Ty2wv8s7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S1:5GZWTpwkc/u/7IoRnUKfq1Dl4DYk

  Score

  10^/10

  lummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1