Lumma Stealer ZIP Archive malware analysis – da1cad41ac6b

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

5 malicious · 1635 files

ZIPda1cad41ac6be8b944d29851ad2b7e8bLumma Stealer

BINLib

PYabc.py

PYaifc.py

PYantigravity.py

PYargparse.py

PYast.py

PYbase64.py

PYbdb.py

PYbisect.py

PYbz2.py

PYcalendar.py

PYcgi.py

PYcgitb.py

PYchunk.py

PYcmd.py

PYcode.py

PYcodecs.py

PYcodeop.py

BINcollections

PYcolorsys.py

PYcompileall.py

PYconfigparser.py

PYcontextlib.py

PYcontextvars.py

PYcopy.py

PYcopyreg.py

PYcProfile.py

PYcrypt.py

PYcsv.py

BINctypes

PYdataclasses.py

PYdatetime.py

PYdecimal.py

PYdifflib.py

PYdis.py

PYdoctest.py

BINemail

BINencodings

PYenum.py

PYfilecmp.py

PYfileinput.py

PYfnmatch.py

PYfractions.py

PYftplib.py

PYfunctools.py

PYgenericpath.py

PYgetopt.py

PYgetpass.py

PYgettext.py

PYglob.py

PYgraphlib.py

PYgzip.py

PYhashlib.py

PYheapq.py

PYhmac.py

BINhttp

PYimaplib.py

PYimghdr.py

BINimportlib

PYinspect.py

PYio.py

PYipaddress.py

BINjson

PYkeyword.py

PYlinecache.py

PYlocale.py

BINlogging

PYlzma.py

PYmailbox.py

PYmailcap.py

PYmimetypes.py

PYmodulefinder.py

PYnetrc.py

PYnntplib.py

PYntpath.py

PYnturl2path.py

PYnumbers.py

PYopcode.py

PYoperator.py

PYoptparse.py

PYos.py

PYpathlib.py

PYpdb.py

PYpickle.py

PYpickletools.py

PYpipes.py

PYpkgutil.py

PYplatform.py

PYplistlib.py

PYpoplib.py

PYposixpath.py

PYpprint.py

PYprofile.py

PYprt.py

PYpstats.py

PYpty.py

PYpyclbr.py

PYpydoc.py

PYpy_compile.py

PYqueue.py

PYquopri.py

PYrandom.py

BINre

PYreprlib.py

PYrlcompleter.py

PYrunpy.py

PYsched.py

PYsecrets.py

PYselectors.py

PYshelve.py

PYshlex.py

PYshutil.py

PYsignal.py

BINsite-packages

PYsite.py

PYsmtplib.py

PYsndhdr.py

PYsocket.py

PYsocketserver.py

BINsqlite3

PYsre_compile.py

PYsre_constants.py

PYsre_parse.py

PYssl.py

PYstat.py

PYstatistics.py

PYstring.py

PYstringprep.py

PYstruct.py

PYsubprocess.py

PYsunau.py

PYsymtable.py

PYsysconfig.py

PYtabnanny.py

PYtarfile.py

PYtelnetlib.py

PYtempfile.py

PYtextwrap.py

PYthis.py

PYthreading.py

PYtimeit.py

PYtoken.py

PYtokenize.py

PYtrace.py

PYtraceback.py

PYtracemalloc.py

PYtty.py

PYturtle.py

PYtypes.py

PYtyping.py

BINurllib

PYuu.py

PYuuid.py

PYwarnings.py

PYwave.py

PYweakref.py

PYwebbrowser.py

PYxdrlib.py

PYzipapp.py

BINzipfile

PYzipimport.py

PY_aix_support.py

PY_collections_abc.py

PY_compat_pickle.py

PY_compression.py

PY_markupbase.py

PY_osx_support.py

PY_pydatetime.py

PY_pydecimal.py

PY_pyio.py

PY_pylong.py

PY_py_abc.py

PY_sitebuiltins.py

PY_strptime.py

PY_threading_local.py

PY_weakrefset.py

PY__future__.py

PY__hello__.py

BIN__pycache__

EXEpython.exe

DLLpython3.dll

DLLpython312.dllLumma Stealer

Structure

BINResources

DLLvcruntime140.dll

DLLvcruntime140_1.dll

BINDLLs

DLLlibcrypto-3.dll

DLLlibffi-8.dll

DLLlibssl-3.dll

ICOpy.ico

ICOpyc.ico

ICOpyd.ico

EXEpyexpat.pyd

CATpython_lib.cat

EXEselect.pyd

DLLsqlite3.dll

DLLtcl86t.dllLumma Stealer

Structure

BINResources

DLLtk86t.dll

EXEunicodedata.pyd

EXEwinsound.pyd

DLLzlib1.dllLumma Stealer

Structure

BINResources

EXE_asyncio.pyd

EXE_bz2.pyd

EXE_ctypes.pyd

EXE_ctypes_test.pyd

EXE_decimal.pyd

EXE_elementtree.pyd

EXE_hashlib.pyd

EXE_lzma.pyd

EXE_msi.pyd

EXE_multiprocessing.pyd

EXE_overlapped.pyd

EXE_queue.pyd

EXE_socket.pyd

EXE_sqlite3.pyd

EXE_ssl.pyd

EXE_testbuffer.pyd

EXE_testcapi.pyd

EXE_testclinic.pyd

EXE_testconsole.pyd

EXE_testimportmultiple.pyd

EXE_testinternalcapi.pyd

EXE_testmultiphase.pyd

EXE_testsinglephase.pyd

EXE_tkinter.pyd

EXE_uuid.pyd

EXE_wmi.pyd

EXE_zoneinfo.pyd

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL #2	http:/huhuhuhuhuhuhu
URL #3	http:/huhuhuhuhuhuhuhuhuhuhu
URL #4	http:/huhuhuhuhuhuhuhuhuhuhu
URL #5	http:/huhuhuhuhuhuhuhuhuhuhu
URL #6	http:/huhuhuhuhuhuhuhuhuhuhu
URL #7	http:/huhuhuhuhuhuhuhuhuhuhu
URL #8	http:/huhuhuhuhuhuhu
URL #9	http:/huhuhuhuhuhuhuhuhuhuhu
URL #10	http:/huhuhuhuhuhuhuhuhuhuhu
URL #11	http:/huhuhuhuhuhuhu
URL #12	http:/huhuhuhuhuhuhuhuhuhuhu
URL #13	http:/huhuhuhuhuhuhu
URL #14	http:/huhuhuhuhuhuhuhuhuhuhu
URL #15	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential