logo

LummaC2 Malware Distributed Disguised as Total Commander Crack

ID: 4e5927dd-e10d-5ee8-84e7-2838e6cbab5b

STIX ID: report--4e5927dd-e10d-5ee8-84e7-2838e6cbab5b

Feed Name: ASEC

Threat Score
70/100

Date Published: 2025-02-18

Date Updated: 2026-04-26

Author: ATCP

...
...

AhnLab ASEC discovered LummaC2 being distributed as a malicious "Total Commander" crack: users download a password-protected archive that runs an NSIS installer which launches an obfuscated batch and AutoIt (.a3x) loader that decrypts and loads LummaC2 in memory. The malware is an information stealer targeting browser credentials, email and wallet data; the report includes IOCs (MD5s and URLs), detailed TTPs, and advises obtaining software only from official sources.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.