Extracted

• • Target

    eb8ee9140516ed888bc9fde920f1753e0e31c53e53a81e939398891a72da01c5.zip

  • Size

    12.5MB

  • MD5

    8f6b28680999dd2eab006ef55f467642

  • SHA1

    0656d1a4ff13bf016cc4ae357ef78afb2daa8c36

  • SHA256

    eb8ee9140516ed888bc9fde920f1753e0e31c53e53a81e939398891a72da01c5

  • SHA512

    3adf016414509a4287d684f0273a25890d5f3692dbd107aa55e6bbe9ebda6eb07babba69404c618ff13722984f6873b6670a2e9a462a60782ecb185592bcd27f

  • SSDEEP

    196608:0qwwMYxS0KY8dM5n7FuaDUg8pqIGjZYgkCnWInnjKFnAtyVAEyUX7HJW5cJonE:zMIMdM5n78KjXkCnWIeAXEyUrpW5ZE

  Score

  10^/10

  lummadiscoverypyinstallerstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2