Extracted

• • Target
    setup.exe
  • Size 1.0MB
  • SHA256 dd5691dd8c38d6c0d5958373603fffc3e0bec43b279f1a49154ba0dec3d5deee
  • MD5 b784eaba119c0fc6ad65c71b2bf43faa
  • SHA1 7efb03a39f7e71fd968d7153178fd24bb2900459
  • SHA512 223605fd28cad88da31fb493b07f33d63b49866b6571c8c3c276fa9ca4eb86e5adc413a074dd337e2943d58a1e9d56b313d19265aed1f31f91ff086ac0ea86b4
  • SSDEEP 24576:X0a5/Vlizg4zL7rwU/bwPYUCLiB1ypyrXcQ94lSQ8xb:X7VtUj/kPF3mQWlOxb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery
  behavioral1
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
  • MD5 08e9796ca20c5fc5076e3ac05fb5709a
  • SHA1 07971d52dcbaa1054060073571ced046347177f7
  • SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
  • SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral2