Extracted

• • Target

    Xeno_V1.1.3.exe

  • Size

    50KB

  • MD5

    9a84584e9b7af26c60a23333ff39f0ab

  • SHA1

    2dce5c9778041b18d7f50deb166528aed8cba73d

  • SHA256

    9060c8b14a3374ce332ab3e83514a5564379c3e50b63831d666d03d793283d8c

  • SHA512

    148894bf52accfe7b250e1e7c4d95d6d298fb95ee1a1516a29550b94cc748f7c52339fa332bf0db885ad9ac463d0dc185e083357dcb5a3e8a962d8c758a5c5a5

  • SSDEEP

    768:0jKOb+/J7MCtTbvOYpCK0G+raKvq36QFtwoO0G+raR:c67XbvOYpVaeFOrl

  Score

  10^/10

  discoverylummaexecutionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2