Extracted

• • Target

    0d3099a1c2c980ff1cb0424c89254f704342037596ceaf7aa6c82d6cec8203e0.zip

  • Size

    68.4MB

  • MD5

    b16e4988d30f4d3138b151fcf1809966

  • SHA1

    af374b8d8f52e182ca0fc3769cec8779cf1a2d39

  • SHA256

    0d3099a1c2c980ff1cb0424c89254f704342037596ceaf7aa6c82d6cec8203e0

  • SHA512

    195af50cff3bb07a63a1f8c1b37e8f60fabbb679db16dac1645e847d026504007780a3aa09db1548f101a6a79b9217afc966948d378dc88117b9df59eae40562

  • SSDEEP

    1572864:f1Bktt21Ys9ZNJa8CPbxtVqfsY8yHEn8QO3ek4HHHsFIcXrKYGng:bktt21bl2xtVqfNEnuOkS2X2YGg

  Score

  10^/10

  lummadiscoveryexecutionpersistenceprivilege_escalationstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2