Extracted

• • Target

    🌼𝒩𝑒𝓌✳𝐂𝓸𝒹𝑒✨𝐏ατ¢н-𝓘nst𝒶ll@9192/Setup.exe

  • Size

    168KB

  • MD5

    aef6452711538d9021f929a2a5f633cf

  • SHA1

    205b7fab75e77d1ff123991489462d39128e03f6

  • SHA256

    e611a1ffbe9e08a2660bc290a581aa0b54637524aaf6040a70e54f97136ce5ac

  • SHA512

    7ad84d4d3bab3f5a3e14f336d8931bf4b876299000081b2a94a3fcf698c56b82514753b483c5b8d7ae84ddd92ee1c4043fa5e7fb7c4f7e9eb52ca8c794e508b7

  • SSDEEP

    3072:+CNUaViEqjY1uimO3soWBgZNENeo0TzSCOtCUon/BA2gGaA44:dwEq7HO8ohEsxHSC+CUO/Bxk4

  Score

  10^/10

  lummadiscoveryexecutionspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3