Deep Malware Analysis of 2c38d87650929640b2f04d813e1e6224 | md5: 2c38d87650929640b2f04d813e1e6224 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | Stealer | Lumma Stealer | .Net | SOS: 0.93

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

PeID

Microsoft Visual C++ v6.0 DLL

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_3c1df609.bin (11411 bytes)
Module Name	TessaTessaWilliam.lnkozbw
Full Name	TessaTessaWilliam.lnkozbw
EntryPoint	`System.Void ⁫⁪‭‎⁬‫⁯⁭‫⁪‏‫⁪‏‬‬‏‪⁮⁬‭⁪⁭‍⁬⁫‪‎⁬‫‏‮⁯‫‏⁫⁬⁪‮/⁫‭⁯‏‮⁪⁪⁫‎‏⁭‍⁮‬‎⁮⁭⁮‍‎‫‬‬‮⁪⁯⁪‫‮‭‍‏‍⁫⁬‬‎‏‮::‪‪⁪⁯⁫⁬⁯‌⁬‬‏⁭⁭‎‍‍⁭⁫⁬‪‬‫⁮‏⁯⁬‏‬⁬‬⁬‭‏‬‮()`
Scope Name	TessaTessaWilliam.lnkozbw
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	TessaTessaWilliam
Assembly Version	9.0.4.6
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	35
Main Method	`System.Void ⁫⁪‭‎⁬‫⁯⁭‫⁪‏‫⁪‏‬‬‏‪⁮⁬‭⁪⁭‍⁬⁫‪‎⁬‫‏‮⁯‫‏⁫⁬⁪‮/⁫‭⁯‏‮⁪⁪⁫‎‏⁭‍⁮‬‎⁮⁭⁮‍‎‫‬‬‮⁪⁯⁪‫‮‭‍‏‍⁫⁬‬‎‏‮::‪‪⁪⁯⁫⁬⁯‌⁬‬‏⁭⁭‎‍‍⁭⁫⁬‪‬‫⁮‏⁯⁬‏‬⁬‬⁬‭‏‬‮()`
Main IL Instruction Count	4
Main IL	`nop <null> call System.Void ‎⁭⁭⁮‭‬⁪‮⁮‌‎‭‫⁭‮⁭⁬‍‫⁫⁬‌‏‍⁮‪‏⁬‮‎⁮⁫⁪‎‍⁮‌‮::⁭‏‏‮⁭⁮‌⁬‫‪⁮⁭‮‌‌⁬⁯‌‭⁬⁭‪⁯‭‪‌‬⁭⁪‭⁮⁯‪‏‎‍‏‪‮() nop <null> ret <null>`

LummaEncrypted@00015976 [dddddddd] UNKNWOWNmalicious

LummaEncrypted@0001B4AB [9876543210] UNKNWOWNmalicious

?huhuhuhu

LummaEncrypted@00064052 [0123456789abcdef] UNKNWOWNmalicious

?huhuhuhu

LummaEncrypted@0006407A [00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899] UNKNWOWNmalicious

huhuhuhuhuhuhuhuhuhuhu

LummaEncrypted@00065795 [000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF] UNKNWOWNmalicious

huhuhuhuhuhuhuhuhuhuhu

LummaEncrypted@00065A38 [c8a131f8922d] UNKNWOWNmalicious

Zhuhuhuhu

LummaEncrypted@00065F12 [b9abc76ce53b6fc3a03566f8f764f5ea] UNKNWOWNmalicious

\???huhuhuhu

LummaEncrypted@0007BA28 [F7C6B63E2E47C088B97B4366DC5B68C37CA992C18646FD5BA3F8BDF29734427C] UNKNWOWNmalicious

??v?N?huhuhuhuhuhuhuhuhuhuhu

LummaEncrypted@0007F4D0 [8dd1a5ab2dd4] UNKNWOWNmalicious

?huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential