Extracted

• • Target

    Setup.exe

  • Size

    685.0MB

  • MD5

    daec90546d38415dc7b8261fc7061d5f

  • SHA1

    91d2740295571d9f4b20966bc72b0c921ca74021

  • SHA256

    0c4f831e8eeb2536a313db487f7e5fbb3807daaeab8d493ff151f85c0977d7d6

  • SHA512

    9a23a62cc4d8039fab66728cc3c52cb41e4eb45f61d79e8b5e7e8470293e5a780bdc994518d64a3169e5d11566f12874715dc012b531a8087582b0fce2aec83d

  • SSDEEP

    24576:tq/Ab3dWy7fZn2AIgQYKMv2/by8g/TD6ohMtzfDlxyHG846vZntUdSv8eKh/kcO:E/edb7fJfaOTD6ohkD/aHmeS/kR

  Score

  10^/10

  lummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2