Extracted

• • Target
    2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar
  • Size 4.0MB
  • SHA256 52fb8ffb7ccce4a3f89cc4804c7909da51cbe307b07baaa0f8360823f6e69cc7
  • MD5 dd77e6a2c8750c7590d967cf4b153998
  • SHA1 957a87daca16b70649e23e3f506cccdbe8b22984
  • SHA512 969be83a61eadd9aa6d86f3724155a7f885218dde919948cd5e1f08e41d6e50d074f5300fbe4f6fb4a4520bcd87e0013dce504eb6a47c24aaeb39d51d11e21a8
  • SSDEEP 98304:3wyMBap7IjfgKwgEAmiWDxk1BDjGdsXk4Y05hWNEERrA//EoZZ:3wyMBap5hiWDkDaJX0eTrA//E
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoverypersistenceprivilege_escalationstealerspyware

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2