Extracted

• • Target
    𝗦𝗘𝗧𝗨𝗣.exe
  • Size 1.1MB
  • SHA256 0040cda86058738ebde0150d7ed174aeb24b06fe9c11c17aa41a1385b0a258bc
  • MD5 fcf115a2c2df78895428fcc07627c264
  • SHA1 317e7923fb2133218eecfc6c8ae82c5522bd3b3f
  • SHA512 d191c69fc6049f90cca3970952680d6aca70f2ea58c912c80401684e2bee7de54936496425969d84d8a541ff54c86091a8e158f6bcd5b998575ac8a171469795
  • SSDEEP 24576:94iTSPWRK+0J9m659CYEDegd2YRL06edUy6UjyUyTTVqpCqVksXVIVj3:ai+ORF0J9mi9CygngjaUys4q2slI53
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
  • MD5 08e9796ca20c5fc5076e3ac05fb5709a
  • SHA1 07971d52dcbaa1054060073571ced046347177f7
  • SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
  • SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $TEMP/Capacity.swf
  • Size 282KB
  • SHA256 478095b34c9575c9c912ab7f4a09850bfda14b37d520f77fc5712a4cfe03b8a6
  • MD5 4703d0497dbe41daa5793816fa8ac867
  • SHA1 5e6c29b0bbdc147166d661529fcd0466ca896b66
  • SHA512 bad08ba6c03a336684d565b2c5246d3f60cdbf61d6b8b49793889507653ab246810436811ebcf1bc3c23b5bbca52240724f0b26fa9e57f0e306183cbd7eb01fd
  • SSDEEP 6144:beAvUHADRK5/4rAK2+yhDqRh4bMu8SPWb25W0QpdLVGL5TP1:qaCSaQrN2jBqvNu8oWbWep5V21
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral5behavioral6
• • Target
    $TEMP/Constantly.swf
  • Size 38KB
  • SHA256 a7970d83fe5d51b656b777cbe307b46016d2f33ff7c6a8de101f3ce0a9106abe
  • MD5 383effa9644d414063205ee95c146cfb
  • SHA1 7813c223edf20accac832b4f94fd6b113f95ba5d
  • SHA512 504f470937ffd0804d27cf093333125814646d48a4aaaccc0a9f885d9769d9b28011758b6f82e2398aca4253404eadec5fdadb3fe3ae4c23ede66a2d900beddb
  • SSDEEP 768:qDNoKnNInheKbKGL1Fl+4e20i/oePpX8ZvNSF5+Af6/sNrx5LIHFmpENAntPK:qDRnN8kAj+4eDOoQ18ZF0+Af6i2nAti
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral7behavioral8
• • Target
    $TEMP/Example.swf
  • Size 22KB
  • SHA256 727138f17650563887846240251d034ea2a7cb2bb462e4e972be5d1331dbbac7
  • MD5 c270e3f590223d318786671d21c10be4
  • SHA1 494d1e411a6642be0117fa84b169cc59d182991e
  • SHA512 b65a0189585de1ca322bf6c7d0ecf848c9ca2a605ebb3d8270938d06fab0f774fdde0153ef7c37d3cc2b7d286f0858cadab3116c22617ef0e17dc4ba543af639
  • SSDEEP 384:FrY7KkW5WDxwWa5vYazCBBJs1Rlm6fxwzCmCN4CI4W/Wx:FcuJ5Wxw/wt4Rlm6OzCD35
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral10behavioral9
• • Target
    $TEMP/Neon.swf
  • Size 194KB
  • SHA256 f4932170f3e9a79f3624b1fa290c7d95d5209f9e0a796342dff98c42f3897255
  • MD5 de33d93585b41fb1bc680ce015743a36
  • SHA1 142dfff3acc2c3ef42d156f091b9ced208de7646
  • SHA512 2c4629b4972e5fadc3dcceba6c3f49a5a0a02daa73eecc37e7c3c5f596bfabe8f4c6e98e94e1d4a51c3526e50dd26e30bc29c09222744b8e3c71db4f4fff9a4a
  • SSDEEP 6144:MZzVVzYdcIijPlARJWfhbWsakGoh/z+m9iGbdaag:MxvrjPl0JWfhby3Aim0qdQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral11behavioral12