lumma | fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b | Triage

Sharing

General

Target

fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b
Size

251KB
Sample

230116-md3r8ahd7t
MD5

fe7dd689396bf62715c45735c2761eca
SHA1

2d7e535ddafa3eb554f87314c8a3634d819dc778
SHA256

fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b
SHA512

4cd59f82e826efe24c19a8f1d009ac021ad8f2b75006a1babb22141bcd5f76cdec0960680868e11604ee5a896c2494cbcde72349901916888f4d09cf68ccac51
SSDEEP

6144:V1W1XLCCPACUbYmS7beQXgmyYNOf7rd4VDHXyUC:V1WB2oAxub5s2O3ci

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b
- Size
  
  251KB
- MD5
  
  fe7dd689396bf62715c45735c2761eca
- SHA1
  
  2d7e535ddafa3eb554f87314c8a3634d819dc778
- SHA256
  
  fec1f657f269aa04c8cac90b500c8a2c95faef8db1e20b504617f7dccad5eb1b
- SHA512
  
  4cd59f82e826efe24c19a8f1d009ac021ad8f2b75006a1babb22141bcd5f76cdec0960680868e11604ee5a896c2494cbcde72349901916888f4d09cf68ccac51
- SSDEEP
  
  6144:V1W1XLCCPACUbYmS7beQXgmyYNOf7rd4VDHXyUC:V1WB2oAxub5s2O3ci
Score

10^/10

lumma spyware stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lummaspywarestealer