Overview

overview

10

Static

static

3

Qv9nk40.exe

windows7-x64

10

Qv9nk40.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Qv9nk40.exe

  • Size

    1.2MB

  • Sample

    231226-bjyjxaaeb5

  • MD5

    6983d668ac2d110a95dee305483b0b4e

  • SHA1

    6b248c5ab6f4acc691a2737a9d946c0eab33b6fa

  • SHA256

    b9f69c03f5d2f0190f98375d442160b4bf00071f5f4845a1152299c0430f8744

  • SHA512

    cbce64cf5947b88beb5f816ac6c4f1460d3544b1395b45cc7c1925c2abb3b8fce05c569de13351820f49103bb97b87d89ea25211edb4462838b5441e35ad5ac2

  • SSDEEP

    24576:vyZG9PiGlNOe5yxoj4ookRUpmss9yYxGfAP:6M9bQeUxojLVlss9yYEf

Score
10/10
lummagooglecollectiondiscoverypersistencephishingspywarestealer

Malware Config

Targets

    • Target

      Qv9nk40.exe

    • Size

      1.2MB

    • MD5

      6983d668ac2d110a95dee305483b0b4e

    • SHA1

      6b248c5ab6f4acc691a2737a9d946c0eab33b6fa

    • SHA256

      b9f69c03f5d2f0190f98375d442160b4bf00071f5f4845a1152299c0430f8744

    • SHA512

      cbce64cf5947b88beb5f816ac6c4f1460d3544b1395b45cc7c1925c2abb3b8fce05c569de13351820f49103bb97b87d89ea25211edb4462838b5441e35ad5ac2

    • SSDEEP

      24576:vyZG9PiGlNOe5yxoj4ookRUpmss9yYxGfAP:6M9bQeUxojLVlss9yYEf

    Score
    10/10
    googlepersistencephishinglummacollectiondiscoveryspywarestealer

    • Detect Lumma Stealer payload V4

    • Detected google phishing page

      phishinggoogle

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks