Extracted

• • Target

    stage4_inmemory.exe

  • Size

    1.2MB

  • MD5

    8e8280ed88a5435880a63873367b2fc9

  • SHA1

    45bd86a0c42647a66e164e564abfc4b43ad4243b

  • SHA256

    af86b32a933800cf30edb4f8f40cddd74253f599eb3edc8aa643fdfd30621f0b

  • SHA512

    d0d11b59a22f9298c82834c25be137f740e82c91f327f4c883d38bc63caa61c4afbb69a2b0bc76be60201cf69c5e97fbb9b50c9ae745debf741284405efe4218

  • SSDEEP

    24576:+cWEAED8iMPtLVSLRw4ngZDEtvFAK4xwheL57FpbQLYffegKWz2NbGN7Tig:r8Jt4LRfIEtvFJhheL55pbQkffegCNC

  Score

  10^/10

  lummadiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Suspicious use of SetThreadContext

  behavioral1