Overview

overview

10

Static

static

1

JJSploit_7...US.msi

windows7-x64

6

JJSploit_7...US.msi

windows10-2004-x64

10

Resubmissions

01-04-2023 05:34

230401-f9mbsahe9v 8

01-04-2023 05:33

230401-f83blsgb87 6

01-04-2023 05:30

230401-f699fahe7x 10

01-04-2023 05:26

230401-f4ttnsgb52 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JJSploit_7.1.3_x86_en-US.msi

  • Size

    5.8MB

  • Sample

    230401-f699fahe7x

  • MD5

    89b39aafa577686ce2890ff00a22f7d6

  • SHA1

    1259bb1962d23f242ebe340f359b3825a31989d4

  • SHA256

    dfdb140d98307146cbdbc726cc1f4897acc14288c95fd8bfc5ab29f91c895fa3

  • SHA512

    59d7ee87354f01c9bcaf438086a730f56c671f75815be696b07107d54f886b48a7217a7c4138e690a6c0670b7c39dd564650b63e6e12743d46b3bd65824ad70d

  • SSDEEP

    98304:oni7F600rU+xmX0VumSuS2eaYbC8wSKyWatyiGoMNjbLmf19+I3NlNi3bywir:Gi7F6MiVVBS2e3bC8wS+QGZNYpi2

Score
10/10
lummastealer

Malware Config

Targets

    • Target

      JJSploit_7.1.3_x86_en-US.msi

    • Size

      5.8MB

    • MD5

      89b39aafa577686ce2890ff00a22f7d6

    • SHA1

      1259bb1962d23f242ebe340f359b3825a31989d4

    • SHA256

      dfdb140d98307146cbdbc726cc1f4897acc14288c95fd8bfc5ab29f91c895fa3

    • SHA512

      59d7ee87354f01c9bcaf438086a730f56c671f75815be696b07107d54f886b48a7217a7c4138e690a6c0670b7c39dd564650b63e6e12743d46b3bd65824ad70d

    • SSDEEP

      98304:oni7F600rU+xmX0VumSuS2eaYbC8wSKyWatyiGoMNjbLmf19+I3NlNi3bywir:Gi7F6MiVVBS2e3bC8wS+QGZNYpi2

    Score
    10/10
    lummastealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks