General

  • Target

    9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204

  • Size

    290KB

  • Sample

    230714-3r3x5sgd76

  • MD5

    6d35d4cb11e99f8645441b0f1f96da3d

  • SHA1

    3b6e12da0c1c37d38db867ab6330ace34461c56a

  • SHA256

    9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204

  • SHA512

    01b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4

  • SSDEEP

    6144:bLpjxNBiWYJ+KZfQWi3E+sT3YswnFknEf9zdCRnFtDQFr:bNxN4nEKZoWiUHTPe3ft2Ft8F

Malware Config

Extracted

Family

lumma

C2

gstatic-node.io

Targets

    • Target

      9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204

    • Size

      290KB

    • MD5

      6d35d4cb11e99f8645441b0f1f96da3d

    • SHA1

      3b6e12da0c1c37d38db867ab6330ace34461c56a

    • SHA256

      9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204

    • SHA512

      01b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4

    • SSDEEP

      6144:bLpjxNBiWYJ+KZfQWi3E+sT3YswnFknEf9zdCRnFtDQFr:bNxN4nEKZoWiUHTPe3ft2Ft8F

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks