Extracted

• • Target
    Setup.exe
  • Size 1.1MB
  • SHA256 e376ba77a33c9955be2bbb9fe65b4fa50173c6fd430f88bdb07303feb679012e
  • MD5 de769e89d3982ca2eca390431ab7d0eb
  • SHA1 4e3e63d40dd2ff3371840f95fc6f369679fc9ab8
  • SHA512 0230bf7849c9e3eab679377cc17d51858bebc35eaca3ba96dfd58e6799b20622dbe0035fa2556a78ea934d9d75d3a13cc0061ed4cb38627f6d77a7c63e5e9271
  • SSDEEP 24576:5tC4GUgZxtrN4Dnlr1iZdPA2TwPNogH+MOspbVeSNH0x0qy7/FEabU:5dKHtrN4xrJLogUsB20qqLU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery
  behavioral1
• • Target
    FreeAmazing/Logos.xlsx
  • Size 77KB
  • SHA256 b420ad4562ff3ade45adc95658e4de58d62153fa01383c8e42fdfab34112fca8
  • MD5 5021152e3ac9945db097ab1862027c02
  • SHA1 cee8c1342a455106e14c43bb08f521ea5833e1c1
  • SHA512 e6e03e75a20369f3b6a0d7c97fbc4a949ccbd30d268fba55b1fcd819fb24cb329c7bf221172968374839595cc87d834ea1177dbed1fdde6607b5d003c6fecf4b
  • SSDEEP 1536:YIEg2szvU+IuaM/WSIx4p3WMVpQidulXYKDaGwOiMtYWaj4GLLLDEYlyfwnqbHS:YYfTIiWSICHPq4pqrtGf0SnqrS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral2
• • Target
    FreeAmazing/Title.xlsx
  • Size 92KB
  • SHA256 efd09b492f02fa8940c07726c6b2f74184ff753292e18328c7192551638d7d04
  • MD5 df5c0014302342c10bbf40d39a7881af
  • SHA1 5ddc818cbfa0c4dd9f1e36e0ac91a9d851615002
  • SHA512 e5b71d841d670d9392bf8adffc3db2b8a29aa82d4a27ba0be7577a68d5e1dfc2b07a3d92fe64934069e34d0afb848e75150a22607e8743806d2493259fa83bf3
  • SSDEEP 1536:sq/pAiS9phxRqIYLXc5r3GOhdJ4wWCj6O4pQNLJS892ZLh74dvgezYEtix:xAF9RqIYLXiBDdOrpuQ80xhcpgmzu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3
• • Target
    GoodsSolaris/Flame.xlsx
  • Size 20KB
  • SHA256 6fea3a7d5fd43598f9595bfee05505a4a97f438d2d2e831bd8d29a3d31e9ba7d
  • MD5 e5b9a65dcd4ee35017b15417e29b8811
  • SHA1 0dfbab518a7dda9d9e054725cea9252f25d96652
  • SHA512 6c2f3e89b5064766e13a880e0a364f40d5f4f88bb89b8108e1b925c7ae52cf8c0cdc5f6ee29fc49606a561fb3990dced1b38d2bef6c4ae9509ade659098a2b2f
  • SSDEEP 384:jDXPXHywG2exeuCzs7gye3T3EEFKeq4y7guhWRdvasmmUhDtlWt:jD/S2exebzsFqT0Sq4oqSJmUhD2t
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral4
• • Target
    LoudInflation/Card.xlsx
  • Size 58KB
  • SHA256 3ce93685b9f7f53ba4b8dd881307480763fbfb60b5c1bcbadbb317b20e88035d
  • MD5 03ad2cf4462700a1a4dba683c19283a3
  • SHA1 9bf62968003fdde2e24ad1d469e24be43d284ef4
  • SHA512 9cf512369cf6af51170731a19fa79d8b4a86ce6c1a14e86326125234fbf76f49e06e5d735aef82f9cff38335692c3e618b8941a3b384d9f20f932e0fc3beaec7
  • SSDEEP 1536:b7Oe+OSKphPUq2PrE3hOBj/937utyG8lU:b7BSKpOjBBjV37hfu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5
• • Target
    LoudInflation/Catch.xlsx
  • Size 58KB
  • SHA256 2b443f3520a85db6428e5be491df8dd5787062cc36c302b34b93d3fc644a49e4
  • MD5 3454a7da9ed686ff4dfb3e403491a5ec
  • SHA1 4eec8b12d051bbe368fd19e362098a8434efc040
  • SHA512 5b82f6a24a37ea88aa7d6db0afd890122b295dc6e65313318e74c5039eea47838223e98ebb037ee493b01d874e06111404fbb417969bddf47ac91eb9fef62848
  • SSDEEP 1536:MaejqKmjFnWgisRlnKMFqKyODcF8Dd/V84Sy4RQfsQ:MHjDmpWgJlh4KBDEky4Sy42fN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral6
• • Target
    LoudInflation/Competitive.xlsx
  • Size 16KB
  • SHA256 ab31a5f411e71632fdc3242cbd3d6f69fa003d280a1bc916a497b984a0ce88ed
  • MD5 b1ca8b528810fefa4716d2a92784d898
  • SHA1 22e02b1eba8ef94dd3ac2f98e76fb9ea9864175a
  • SHA512 090e6e3f826256716402d6e27dacd007ca3e7c62c0aa7515dddaa410e41da4ad6e73c6a7d6303ce65b2f7c9213f5ed6ace0e88a83b85b1a3e3b5b5c0cc0ff743
  • SSDEEP 384:u8S53FxcE/8IdWPs0pidF4HwyMp+eCS8m3CWleXPjXY5k52QmYCWaA8Xx+JHFiuk:ubx7/8IJ0MoQaPSN8c+JlidB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7
• • Target
    LoudInflation/Drove.xlsx
  • Size 89KB
  • SHA256 786a5f6ecbb185255dd3cc8eed7da80432b8fe81249aef7bda4dc4d3c04e64b9
  • MD5 78230d9865c677b93e2d016ce3b54f03
  • SHA1 491c24290a689ae98b73629e10a8ea4dfc1fe9ea
  • SHA512 bcb64cd1f0fa6eb182863ad5baa515dcb1e504b2751296858ab6c0add0993c6588e40b8c6254338d90931905302ad223d516b9bbe8554b8e7487dab176809097
  • SSDEEP 1536:mOkOKaZHjRzN/LWF/xfiIZ7QI+W/Bmrhg9c2nAc2liJqnixqx6nmT:mOkaZFzNLG/xfZZ7J9/BmMCiJSi46nmT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral8
• • Target
    RenaissanceAdvantage/Cindy.xlsx
  • Size 96KB
  • SHA256 fe8722abb84523f3e75e6b37cf3cf686d75f86945398bda69063c5f54ad25f02
  • MD5 1cd1b712f956f74e0a080c0bc08da084
  • SHA1 e2bf76886f6c1089bcda933c550498c57eadbdfd
  • SHA512 41fa42b91a4c692fea74567e53acc072e45edc92c16189b6c739ef803ba4c71cd31083aa533cc62d7229d3186d9e23ee8a80f0f6f2acd1ce4b254384a8b398e9
  • SSDEEP 1536:HvZ6bW4e+aDoAR26HUyCMJ5Zp3V6/Yq/H+LZgfLh7vHLrRJGI6YfgYjz:PZ6bW7bcAREyf76PeLiTtvHXiYTz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral9