lumma | d932ee10f02ea5bb60ed867d9687a906f1b8472f01fc5543b06f9ab22059b264 | Triage

Sharing

General

Target

d932ee10f02ea5bb60ed867d9687a906f1b8472f01fc5543b06f9ab22059b264
Size

158KB
Sample

230214-lc8reacc59
MD5

c9c0e32e00d084653db0b37a239e9a34
SHA1

b97965e4a793ec0fa10abc86d0c6be5718716d8a
SHA256

d932ee10f02ea5bb60ed867d9687a906f1b8472f01fc5543b06f9ab22059b264
SHA512

9579b08ab213e4bad5be8c3a43567dc2e3880b3f2cc51308d2b8a083a4c1a50c92ed1db4f3ecea62f60e1b332714b993c8f01343478701d2f476544afc9e8fa7
SSDEEP

3072:SZEsdw9MDdPyebt3JM0sknMIYIAsfJJ4MfehihzynMT0bLbFdOTwSG:IEsde4JfaIV/4KehQznDwSG

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

195.123.226.91

Targets

- Target
  
  d932ee10f02ea5bb60ed867d9687a906f1b8472f01fc5543b06f9ab22059b264
- Size
  
  158KB
- MD5
  
  c9c0e32e00d084653db0b37a239e9a34
- SHA1
  
  b97965e4a793ec0fa10abc86d0c6be5718716d8a
- SHA256
  
  d932ee10f02ea5bb60ed867d9687a906f1b8472f01fc5543b06f9ab22059b264
- SHA512
  
  9579b08ab213e4bad5be8c3a43567dc2e3880b3f2cc51308d2b8a083a4c1a50c92ed1db4f3ecea62f60e1b332714b993c8f01343478701d2f476544afc9e8fa7
- SSDEEP
  
  3072:SZEsdw9MDdPyebt3JM0sknMIYIAsfJJ4MfehihzynMT0bLbFdOTwSG:IEsde4JfaIV/4KehQznDwSG
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2