Extracted

• • Target
    tmp.exe
  • Size 470KB
  • SHA256 0fcaad56c4f34a72d0fab48468d54e7d0dd2b87e843aa794c8e117d44c8dad93
  • MD5 81e1208ae8132eb999008c173bc886d7
  • SHA1 ccc6b3a50d4e788f90536d2f8c148f12c0b78850
  • SHA512 61c481f3b917f98b8a5b12728e46dbb7a248a6fcf1417e149edf332cf831b37217694b1e30737d2b6e4fc783a8f4fdecfefee74386412d97623c900220f97e7f
  • SSDEEP 6144:vhWyLn1o7eU9VSB+V5Tcyb+jAURmMfGp4IhB8AnlYxnNcZ8tDgJiw8rQAOH80J0K:plj1oyUvSlVtmMw3uxGeRXJOHt6uBS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryspywarestealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2