lumma | 247ab0e8ef27732ed2f39829d4229c3a3b6bfe461674818c730dfeecde8eca23 | Triage

Sharing

General

Target

247ab0e8ef27732ed2f39829d4229c3a3b6bfe461674818c730dfeecde8eca23
Size

245KB
Sample

230115-amy46sff35
MD5

1a4cb36561008522c8b528e1e1ea962a
SHA1

3b9bdcd2cc23dfc50c4ec61a55a6ba81f323fa89
SHA256

247ab0e8ef27732ed2f39829d4229c3a3b6bfe461674818c730dfeecde8eca23
SHA512

586aa9385e3b96589665a91f9228230173b80bc5d5ce0802eea325eb74dc6e6d2bedcdd293e14f8ba4ae4a461da01abfb5c88d9263ee37543531dda8a9a9cb15
SSDEEP

3072:GXtWU8Pw93d+c45CPR1LG/pxR5oX/dghPPQd4ZYr8qna0xZc8Yevapb:u8Pw93t9gU4QuLWyp

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  247ab0e8ef27732ed2f39829d4229c3a3b6bfe461674818c730dfeecde8eca23
- Size
  
  245KB
- MD5
  
  1a4cb36561008522c8b528e1e1ea962a
- SHA1
  
  3b9bdcd2cc23dfc50c4ec61a55a6ba81f323fa89
- SHA256
  
  247ab0e8ef27732ed2f39829d4229c3a3b6bfe461674818c730dfeecde8eca23
- SHA512
  
  586aa9385e3b96589665a91f9228230173b80bc5d5ce0802eea325eb74dc6e6d2bedcdd293e14f8ba4ae4a461da01abfb5c88d9263ee37543531dda8a9a9cb15
- SSDEEP
  
  3072:GXtWU8Pw93d+c45CPR1LG/pxR5oX/dghPPQd4ZYr8qna0xZc8Yevapb:u8Pw93t9gU4QuLWyp
Score

10^/10

lumma spyware stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lummaspywarestealer