Extracted

Extracted

Extracted

• • Target

    complete-this-to-continue.html

  • Size

    4KB

  • MD5

    1e8806239ca150b6da46ae985edc2ce4

  • SHA1

    a722167fe371437aa735718cf772d03ed4d7e225

  • SHA256

    48d5ec1851b92ae79d8bcf69c904b7eb5126c9bbf472333d2f269ec1430b373d

  • SHA512

    67ff81f52d1b32ffae93f1fb9d59778f47df8d109d0cc0c1793c0addfad72152c38f57bc3e6d72c2813ec6f52ecb9f7c15ede10c4216e8ff22271612664422d8

  • SSDEEP

    96:SWHqSNEk6h39WgrQDBcTI5FkLofmfqMOSs:SWl2h39gD2lLofgFs

  Score

  10^/10

  lummadiscoveryexecutionpersistenceprivilege_escalationstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1