lumma | 0a53ab41b2eac9f9643de44c797f79103c37bf434a788c1b66a266d115b30fe8 | Triage

Sharing

General

Target

d21f82a8a0b55f753ba26a19444c5364a2b21d8451fcde32f659f57476fc399d
Size

199KB
Sample

230116-hyhwbsbb33
MD5

7945f09475a4a112e5ab9cb1b909c7e3
SHA1

e8f628bb441ea46e9f5821f728456089c2e8dffc
SHA256

0a53ab41b2eac9f9643de44c797f79103c37bf434a788c1b66a266d115b30fe8
SHA512

e6745db42a115d327f89cafe98ca05fd630b1800a38c2e1f59fe64809aea8babeb3a80e4bc891edbb82ad45b6f98a29359583f0279c4deb6553062bebfa2fc14
SSDEEP

3072:WMF9NUZgsqdr2i47D955jzfq/ezgz1Z+LnI2OR1yXerQEnzZg/j8kbSdse1:f9uZgsqdr4nn5K/e8JVr+e0F/okte1

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  d21f82a8a0b55f753ba26a19444c5364a2b21d8451fcde32f659f57476fc399d
- Size
  
  276KB
- MD5
  
  930f2ceba3c8821110756aa19b395676
- SHA1
  
  d2430e3e8dc6c193a90ef93da218c10f830e4395
- SHA256
  
  d21f82a8a0b55f753ba26a19444c5364a2b21d8451fcde32f659f57476fc399d
- SHA512
  
  dc6d093585e171ca366863cce09722e71e3718c8bab6d4432f92ccea6c926191bfbf5a0b7eb570189e070c4c8ca962a504e02f04661d6e3703efa642bec980d7
- SSDEEP
  
  6144:O6o0eLFcKPqdWge8I9h/e8DVr+HJYloDU4zqQna:O6o55cQqoF8ILRr+HJYloDFP
Score

10^/10

lumma spyware stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lummaspywarestealer

behavioral2

lummaspywarestealer