Extracted

• • Target

    e02c4d37bfa2a770c02c7e09110550e033b79ade35a43a5313ce36306b86140bN.exe

  • Size

    15KB

  • MD5

    9f0d913ab96cb45b27cb9b0a1653af50

  • SHA1

    e436acebf1d5147a7a13bfd4677cb4fde6991004

  • SHA256

    e02c4d37bfa2a770c02c7e09110550e033b79ade35a43a5313ce36306b86140b

  • SHA512

    020630f14708020b2dee74f4d416f03ca5297744edc9b685e36325c40ff725817e0807b2b51b4137e1b8e2a58a5a293b755451d47f1699c622c4ede4b6d7bca3

  • SSDEEP

    384:B23iPe9ydCzrtx2M9XyXhCqYCln6ve55VX:BzgyM9eWve559

  Score

  10^/10

  discoveryexecutionlummastealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2