Extracted

• • Target

    1b1521f76dc2d1a101e430d465bf5959.exe

  • Size

    1.0MB

  • MD5

    1b1521f76dc2d1a101e430d465bf5959

  • SHA1

    7ebdca7a5e1a43e5506155636f5b1c182898eeb3

  • SHA256

    044363ef24d3eee654758490d6370fd1fbe211d8f508db31986a3a23dd4fa8a4

  • SHA512

    7e4af46d81c45182fe012bcb18e61cac781d30e442b7b4c5d9759db7820b30afbcdf4d7e37e38ffbbe21fe75b6ed6cde5990e5ede0bb10422f8bf45a0fc8d0e6

  • SSDEEP

    24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8a+IWIjCLeYomVU:ATvC/MTQYxsWR7a1mLBa

  Score

  10^/10

  lummanetsupportdefense_evasiondiscoverypersistenceratspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Netsupport family

    netsupport

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1