Extracted

• • Target
    AIO Checker 8.10.10.exe
  • Size 2.6MB
  • SHA256 70ed41327068060f68a7272cc705ba1eecfa11430e308023eb82d7964f42ed1d
  • MD5 75aee7f868d71cc6f8029aef153092d2
  • SHA1 6b34572c0e0a30bb481ebc131427b738b5cefc8d
  • SHA512 0b2f82f8a9ecdc089365d6be801072219076a960e2d17f4994a527f86c610ab7ff8eeafc30e2dac43fb6a3403cb3188c3c4ab90285c27c48d6533c2bb6ab442c
  • SSDEEP 49152:qn+WnjZHf6OeL4P6joyV7S2BWnjZHf6OeL4P6joyV7S2:+RjgGP6jokxEjgGP6jokx
  • TLSH
    T112D52305D35256C6F82B82FA44529041FA763C22CB758ABB53D8C727DF0B7806E6DBB1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylummapersistenceprivilege_escalationstealer

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2