Overview

overview

10

Static

static

1

Synapse Launcher.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    synapse-v2-launcher-12-5-22.zip

  • Size

    351KB

  • Sample

    230314-25xslscb9x

  • MD5

    b03b887ae392b6f33fad562becfc0482

  • SHA1

    101c2388c16ca7678a8426739ec7a1b505a6f6aa

  • SHA256

    93db5f4e53b9c0514b9c0c4c562be8d8e7c3d64f8542c03b7e7f032a9c5d0c55

  • SHA512

    0c1cd2e1f5c32b76aa8c994b6399acf81c6f9e2558e120d2eefcde9628a162fa4c3c74aae519a59640f49ee6ca1a33f3faeeaea5e8c02aef9749af0c74d4dc73

  • SSDEEP

    6144:tIYeWfLyWEuLGqsdGNNG5cbM8b1O+cy8xHZ/Lm/nukJxxUO3atM/bc1TEia:tyW5EuKwNNyOHc9xHZy/nVtUOL+T4

Score
10/10
lummaevasionstealertrojan

Malware Config

Targets

    • Target

      Synapse Launcher.exe

    • Size

      788KB

    • MD5

      20e1eb6b9b733bbd26ac8be5be603de2

    • SHA1

      36beefc2467d94b5ec9ae843b2bb099898581bed

    • SHA256

      73af760ad2ffdd931210079ef4b719a1a8c41a864e7d0a39faa5c1783fb140d6

    • SHA512

      d486fc560f0f6d94428b58ae041a17053659e78c49fe9154ca9e642d692da43aeb7dd3f03b1aeb428ea398bdbdfab743960c2f0fa885cd97bc31655be2e42e0b

    • SSDEEP

      12288:GoK0iEH0u6YNNCObkXxHDc/n3jUOSpUMh:nipzXonoOSpUMh

    Score
    10/10
    lummaevasionstealertrojan

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks