Extracted

• • Target

    Setup.exe

  • Size

    685.0MB

  • MD5

    0917c78aeb28a72b0d2703f616238ed8

  • SHA1

    ebac45f959cc20a57d03cf8013e298a4e7557790

  • SHA256

    1e91103f5d1b6af2a36fcf0e6d0955eebe68a93b971b417718d912852dd15b10

  • SHA512

    81a5c2d7d280d9d7ff175c0f41aebeab9f636b666b91b09141c975dfb847546b967cfc84b739b93b4b15c2214f5eacfce104acfe98f6ad75662c119284a26956

  • SSDEEP

    24576:yNjZus0ytu4hJn7/hqSQRo0KiV6I+g7o9L7CfKBRUWMN5:GZtu4H7/hqSC/RV632kL7CSBRUW45

  Score

  10^/10

  lummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2