Extracted

• • Target

    c002664469a48ede06c57b592a27b496bfc3cccb75e3fa468d4b3cf562563fc1.exe

  • Size

    14.4MB

  • MD5

    191294c00be02e5bf0807dc1cf52c53a

  • SHA1

    5dbfe490dcc65b2107f9bc0461c9e6767463795a

  • SHA256

    c002664469a48ede06c57b592a27b496bfc3cccb75e3fa468d4b3cf562563fc1

  • SHA512

    7bbefd4dc19290e454e3f4b08eb5f7faf904639a441d96f74c3973db0302a240192e31cf55c3939c7a70e024199754f084eb68a2ecccc0aea803da6a46025bdc

  • SSDEEP

    393216:8ZnXkkkXBPkVr/zc5Vk1LJG9+ydIaxbDdVUD5:8ZXJqkVr/zc521LJG9+ydIIbhGD5

  Score

  10^/10

  lummadiscoveryevasionstealertrojan

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Blocklisted process makes network request

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2