Extracted

• • Target

    vail-vr-trainer

  • Size

    85KB

  • MD5

    485dfb58e1c3ba1b96766a68a0577c83

  • SHA1

    20c523144397240616b4e843a35822c5f91adb8a

  • SHA256

    4d92578b8c66bec39e89c8f6401339a60285763f2543277a8192d9365b026ea5

  • SHA512

    3d5a71f76f311bc62eaa67c79c2ef22f5f3c355e138b17f7b4fab09ae6012df2f4bd8c6d5215b6db3edf5e70a9319a73e9533a51d4d1fb80d9d1798f8f742593

  • SSDEEP

    1536:SqfapeXQ6ihUII7CMxL9II9yWxoO6CF29FCmd7P4bQy1PyhdygjAV63mMH0LCoxh:HSoWyCM1RyWqO6CF29FCmd7P4bQy1Pya

  Score

  10^/10

  lummadiscoverypersistenceprivilege_escalationstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1