Extracted

• • Target
    2026-08-01_d2d6f9683201c3f27420f1104e88bf20_amadey_elex_luca-stealer_lynx_njrat
  • Size 1.1MB
  • SHA256 3f8e54b3c1b5de6a763ebc0606286ad198ee7ad19f9af43fe39be77e99acc625
  • MD5 d2d6f9683201c3f27420f1104e88bf20
  • SHA1 887d3a9dd2540b694ce5793a6a6a00aca07977d7
  • SHA512 f27b781043d1c9124a05f33f65cdfaffd952f9e2f877b6e4d1832f614f82ff3e3e156178983cd4524c25f4a63e7e4ef3061712d6f75f031c93c4810b79e7ae4a
  • SSDEEP 24576:Daa1UjU3qqATpNxwq8jfN6NTN3puIqJ64NNliJPYGB12ANb0Vv+h:11eU3qFTpgq8TN+TXiJ64N3of2ANbMo
  • TLSH
    T1A8451221B9C0C133D867153159F1DBF94A3DF8600F20AADBA7C81B7B9E206D19B3566B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylummapersistenceprivilege_escalationstealer

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2