Extracted

• • Target

    ETool.exe

  • Size

    127.0MB

  • MD5

    9201fd8086ed6252d3fd04426a89aca6

  • SHA1

    ef2439d69b10217304d86f1d0a084a3525a2bf59

  • SHA256

    2327e82bad470c955053d011b1b23481b16ace2a30ac1ec655d5ac457213d0cf

  • SHA512

    eb6102d67f9d8067d62dfba0127669491a215fd2b4470c16a4cd90d499c09be594856da2a14d3d31c71ee8254d3dc46e8ecfcc8570c6111aa19edfb49b3675dc

  • SSDEEP

    24576:10aVFANlrs0kwTD+r0DyheNjEmqj4tC8yjarmo8nf+Z82vIW9:1mNipwTD+r0+hiEmE4tCtjar0f+Z8vW9

  Score

  10^/10

  lummadefense_evasiondiscoverypersistencespywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Enumerates processes with tasklist

    discovery
  behavioral1