lumma | 5579c0c355948a42082a952d9cc47c378b6c4ba51f8e0a3f449364076b1d9df8 | Triage

Sharing

General

Target

b3b025b8445dcbd9b7aca560ad752b74.exe
Size

250KB
Sample

230119-shavwsdc5v
MD5

b3b025b8445dcbd9b7aca560ad752b74
SHA1

eda8da63b902f556e0940e7717d43dcad545857f
SHA256

5579c0c355948a42082a952d9cc47c378b6c4ba51f8e0a3f449364076b1d9df8
SHA512

70eb0ff2a1c4c36a33918f77225c631e08d05f564a577998ff7f63ea3387c4f08da5f5ff3edda649123826dcc96ad7dd82cb5b4f8736583b8a7f29a01a8f6a00
SSDEEP

3072:IX3m3VPLMTnriw5NqaR47ACQK0f1AMlRmxm6LrjFCVjIUa2gvoexNzu3K5+a:cHOVgCN0/l0xm6LrcVjIUapwS+K0a

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  b3b025b8445dcbd9b7aca560ad752b74.exe
- Size
  
  250KB
- MD5
  
  b3b025b8445dcbd9b7aca560ad752b74
- SHA1
  
  eda8da63b902f556e0940e7717d43dcad545857f
- SHA256
  
  5579c0c355948a42082a952d9cc47c378b6c4ba51f8e0a3f449364076b1d9df8
- SHA512
  
  70eb0ff2a1c4c36a33918f77225c631e08d05f564a577998ff7f63ea3387c4f08da5f5ff3edda649123826dcc96ad7dd82cb5b4f8736583b8a7f29a01a8f6a00
- SSDEEP
  
  3072:IX3m3VPLMTnriw5NqaR47ACQK0f1AMlRmxm6LrjFCVjIUa2gvoexNzu3K5+a:cHOVgCN0/l0xm6LrcVjIUapwS+K0a
Score

10^/10

lumma spyware stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lummaspywarestealer

behavioral2

lummaspywarestealer