Analysis date (UTC): 12 January 2025, 13:22Analysis environment: Windows 10 Pro, build 19045, x64

Fluxus-Roblox-Executor-main.zip

MD5:D375896C64D2E8B758D0A191B875A536

SHA1:D79114C5029AEA44F37CBD6FE074948E900C0CA7

SHA256:A545F43635CC85125E34F7613CD2E1C15CD70F6683AE60F4601B9EF762F2CCE2

Analysis result

Threat level:Malicious activity

Tags:

lummastealer

PID	Process	Class	Message
—	—	Domain Observed Used for C2 Detected	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click)
6848	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)
6848	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)
6848	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)
6848	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)
6848	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)
6848	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)
5572	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)
5572	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)
5572	aspnet_regiis.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)

Rows per page