lumma | d6bc7066872bb41c6d87100f3b6eea3da51630a1a2d7acc8773aa8f47f837d42 | Triage

Sharing

General

Target

d6bc7066872bb41c6d87100f3b6eea3da51630a1a2d7acc8773aa8f47f837d42
Size

247KB
Sample

230117-b65azagf68
MD5

f6c7d302fb13748d2aa531b894c60340
SHA1

023779be3831d292d88ee1473906d3dc1988901e
SHA256

d6bc7066872bb41c6d87100f3b6eea3da51630a1a2d7acc8773aa8f47f837d42
SHA512

c9397d3504cd20d3f58d3b5dc56166d85168a25d269a1b92797c8427bc809f3849e672d80a0a516273b9c271d8d91fe879199d62aa1ce5d00c6a5dff249e4e64
SSDEEP

6144:JZZKFLTwScNWEbIShj712Yo03tSxUB3u0DHX:nZWpcNhbrj7/o0dJB3u6

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  d6bc7066872bb41c6d87100f3b6eea3da51630a1a2d7acc8773aa8f47f837d42
- Size
  
  247KB
- MD5
  
  f6c7d302fb13748d2aa531b894c60340
- SHA1
  
  023779be3831d292d88ee1473906d3dc1988901e
- SHA256
  
  d6bc7066872bb41c6d87100f3b6eea3da51630a1a2d7acc8773aa8f47f837d42
- SHA512
  
  c9397d3504cd20d3f58d3b5dc56166d85168a25d269a1b92797c8427bc809f3849e672d80a0a516273b9c271d8d91fe879199d62aa1ce5d00c6a5dff249e4e64
- SSDEEP
  
  6144:JZZKFLTwScNWEbIShj712Yo03tSxUB3u0DHX:nZWpcNhbrj7/o0dJB3u6
Score

10^/10

lumma spyware stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lummaspywarestealer