Extracted

• • Target

    5246314010f60f6f617d5aa428a622b747c847065453b6ab03b209c97f2f36a5.exe

  • Size

    15KB

  • MD5

    cd876124d6463fb67969dae591770c00

  • SHA1

    92eb49eb0aa376e14c74196eb1189febfbf8d5df

  • SHA256

    5246314010f60f6f617d5aa428a622b747c847065453b6ab03b209c97f2f36a5

  • SHA512

    73d874b71c974f518e8b66185a7bd06406f8fe04af135799efd9d1d3d0335717ac3f1df27c69cd9c9c40c30427b2ec333aec0a5dcab53f7b6e33383e58f633d9

  • SSDEEP

    384:B23iPe9ydCzrtx2M9XyXhCqYCln6ve55VXg:BzgyM9eWve559g

  Score

  10^/10

  discoveryexecutionlummastealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2