Extracted

• • Target

    Untitled design.png

  • Size

    183KB

  • MD5

    bd8092e24f639ed1fbaa87745db569d0

  • SHA1

    15f7c9d155057a2660985157d464a733eea9c395

  • SHA256

    76fe2a70d764e2dec6639ba33f9f6fa1e94b7be3108b1b08022ea768a158fd84

  • SHA512

    1ddd6b9a8053a4e3033abb20617e999c9d4c7546123191ff4fc3813f0a7bb66d820fd8ec36de5c7234fd9f689b2def217550ba161966d9afed26586edf24ec73

  • SSDEEP

    3072:OOJbFhztEHNFIwY8zTsP2Q83cTPxoDepexSGhDMKGNQJYW1lWQrTyBLwLL6:OitWiwY8zAPo+PxoDosDhgKGCSW1F6th

  Score

  10^/10

  lummadefense_evasiondiscoveryexecutionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1