lumma | 11eaa4685ef6b2ad1a5a5e0658db510304050f0560337a1a6353355aed768719

General

Target

2f37a071bafb2b5b6cbef810b532496b.bin
Size

80.6MB
Sample

230718-bpxvkaff48
MD5

2f37a071bafb2b5b6cbef810b532496b
SHA1

7d555c981d034b2c38b90a1622d919647168924e
SHA256

11eaa4685ef6b2ad1a5a5e0658db510304050f0560337a1a6353355aed768719
SHA512

aee731ba173b4db407221aacebc1b58efd77749ac498d8781f817c5e474c44f3f6d8a4c4267e5e4c2914cfda3f02106030aa0e482b75853def54023eb54b27b5
SSDEEP

1572864:1UPuLP9uHbUl3IMW9Il8vsx+XSDi4fpHsFWJuAlxRD4RxJ/osOgi:1UPKcHbU35SIDAXSmwpHsF6uAlxRsZo/

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

gstatic-node.io

Extracted

Family

vidar

Version

4.7

Botnet

https://t.me/eagl3z

C2

https://t.me/eagl3z

https://steamcommunity.com/profiles/76561199159550234

Attributes

profile_id_v2
https://t.me/eagl3z
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1788.0 uacq

Extracted

Family

vidar

Version

4.8

Botnet

https://t.me/hwbhjegyuvbgyugge

C2

https://t.me/hwbhjegyuvbgyugge

https://t.me/jhfvykuwgfwekuifwbe

https://t.me/sundayevent

https://steamcommunity.com/profiles/76561198982268531

Attributes

profile_id_v2
https://t.me/hwbhjegyuvbgyugge
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Extracted

Family

systembc

C2

91.103.252.89:4317

91.103.252.57:4317

Targets

- Target
  
  Stealer/663F2250.exe
- Size
  
  666.6MB
- MD5
  
  7ee53007b688c7f40c81160100026f39
- SHA1
  
  4ab59105a39b0e2a55db44a2eeae1c0a3634e1b4
- SHA256
  
  e8e20414885d7bae4da294b531eca58e4ff8d8918345e1bd741f1f3f29e01f68
- SHA512
  
  392d0140a15b7fa4ebbbb3265be841d65a943ab8f732224c7ba7688ca91d439202569df59f4175855898f3a57b8cae0bcd36819133b0d6b01be09ed24b1999b1
- SSDEEP
  
  12582912:sQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQ2QyQyQyQyQyQyP:snnnnnnnnnnnnnnnnnnnnnnnnrnnnnnP
Score

10^/10

vidar https://t.me/eagl3z discovery spyware stealer
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  Stealer/BA00054A.exe
- Size
  
  33.7MB
- MD5
  
  391148ba6a49c21f1561f0b358c4adc5
- SHA1
  
  9eaf6f202172a3bdaa5ef751b9e3ed359eb4557a
- SHA256
  
  75cd90a2f1d3620498799556ea9b9217aa5048c27db0a31f6f365cf01d713bd0
- SHA512
  
  628b51c10748c0635ff3409e14546257ebee44fc45cfc48f1cb51e73d99fa8bbe7cc9e4250a5cecf6059bfbf859aacdbe12670e83103042a6eb346e21f4c4423
- SSDEEP
  
  393216:k5zFjww2tS26qtUkzgwhTlGQx2YR+1WPe6vcYEa75Y7sizuQUZ8q5q5XiMusXNRp:krOiY9TlJckPeK3P7+vDqY9VJnp
Score

10^/10

systembc vidar https://t.me/hwbhjegyuvbgyugge spyware stealer trojan
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  
  Stealer/C4A17DBA.exe
- Size
  
  755KB
- MD5
  
  b0517305850d5be8e02a648bb90a3c6d
- SHA1
  
  24e75c0ea6b07fd3c4e03c6661ed911632f3e784
- SHA256
  
  5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204
- SHA512
  
  17207aec32a872ad024fb2c67e272830454ca69b095c8b43a1db46c842c6e8530b10a3cc9f1c4d596757949d8a2c448bae44d058f614f037cbf93cb036ca26af
- SSDEEP
  
  12288:IsjWYqfNTYmessZerchdW7lRA3aDloJZsjudEDT26qh+kB:IsjWYGYnZQchI83mlamGv6a
Score

10^/10

lumma spyware stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral5 behavioral6