Extracted

Extracted

• • Target
    tmpxv7j3d9o
  • Size 41.2MB
  • SHA256 b6fa22fe67325b24f7044b934e0f364e02723e019cc4c64e4a5c6e4ae031721d
  • MD5 683ac65ff7a2e6b46e560f85452f28c0
  • SHA1 aa47364ad8a75c7f5de26bbb811d7276326c797a
  • SHA512 6e19705a77a99b550e5d80127043b9465877df15046f3214bbdb105284d96e9bdb98a114871a36813004514dbcc7b490630ddd0912e8a01b3ad113d242e1c3e8
  • SSDEEP 393216:WJZOBtGtX0napjTW4GJnOAR/5xKiPfr7MtOSO7LPY8CGGwW/nJ6T3:WJZPtX0IjTU5P8wSO7k8CGmU
  • TLSH
    T1F897BE02B7EC4061F1B75A3099BB9616EB36BD611B30C3CF5250A66D2E737D09E3472A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylummaspywarestealeradwaredefense_evasionpersistence

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2behavioral3