lumma | 6b8838ea9bff0a51596fe3c2b77b3b0a5402c23cc87692d3648d8f4a28ce705d | Triage

Sharing

General

Target

6b8838ea9bff0a51596fe3c2b77b3b0a5402c23cc87692d3648d8f4a28ce705d
Size

276KB
Sample

230116-jn2fcsff3z
MD5

c16ba0f2004c45a448d524867b6dfac5
SHA1

4511810aaa7ce1542ee94adf00e4f510025a189d
SHA256

6b8838ea9bff0a51596fe3c2b77b3b0a5402c23cc87692d3648d8f4a28ce705d
SHA512

460237872e9bcf0e70f3d719b7321171f6969bbb3dac1d1d744b8be590a59f9fcba3cb1331e7c19448f4c4f45a340dd704209154e87f20fcdc80d0b8489a50cc
SSDEEP

6144:qHZfDLuw3OQibtDGS6q8QsVBLNLTE7y0+FtsSsU4zqQna:qHZ7CweQAhz8RVpNLTE+0mtkFP

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  6b8838ea9bff0a51596fe3c2b77b3b0a5402c23cc87692d3648d8f4a28ce705d
- Size
  
  276KB
- MD5
  
  c16ba0f2004c45a448d524867b6dfac5
- SHA1
  
  4511810aaa7ce1542ee94adf00e4f510025a189d
- SHA256
  
  6b8838ea9bff0a51596fe3c2b77b3b0a5402c23cc87692d3648d8f4a28ce705d
- SHA512
  
  460237872e9bcf0e70f3d719b7321171f6969bbb3dac1d1d744b8be590a59f9fcba3cb1331e7c19448f4c4f45a340dd704209154e87f20fcdc80d0b8489a50cc
- SSDEEP
  
  6144:qHZfDLuw3OQibtDGS6q8QsVBLNLTE7y0+FtsSsU4zqQna:qHZ7CweQAhz8RVpNLTE+0mtkFP
Score

10^/10

lumma spyware stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lummaspywarestealer