Overview

overview

10

Static

static

3

06b2a063d4...0a.exe

windows7-x64

06b2a063d4...0a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06b2a063d4f7ed1fbdf89ac4da07890a

  • Size

    242KB

  • Sample

    231229-3adlxsdeaq

  • MD5

    06b2a063d4f7ed1fbdf89ac4da07890a

  • SHA1

    cfbec43e3d4ff6075a9f8593cf83467aa4b2ea40

  • SHA256

    03e9725ebc272cc3c9e07d5d1a50278b35fa72dc209239d076e9376310e71149

  • SHA512

    35f5fdbefc61b4aedeffc159f769add5f1406fb10c48ebfa47da3d8549280ced0373aac150ba16f6f3f6ebe60acf0cea3438c581cae139089c3fbfe3aa95d6ec

  • SSDEEP

    6144:3663lQ0l+9TIddHOCOVrX7tfQN5/inEaMadDKNa1aIc8eH:Xl+1HCOVHtfQunka1KNaTc8eH

Score
10/10
lummabootkitevasionpersistencestealer

Malware Config

Targets

    • Target

      06b2a063d4f7ed1fbdf89ac4da07890a

    • Size

      242KB

    • MD5

      06b2a063d4f7ed1fbdf89ac4da07890a

    • SHA1

      cfbec43e3d4ff6075a9f8593cf83467aa4b2ea40

    • SHA256

      03e9725ebc272cc3c9e07d5d1a50278b35fa72dc209239d076e9376310e71149

    • SHA512

      35f5fdbefc61b4aedeffc159f769add5f1406fb10c48ebfa47da3d8549280ced0373aac150ba16f6f3f6ebe60acf0cea3438c581cae139089c3fbfe3aa95d6ec

    • SSDEEP

      6144:3663lQ0l+9TIddHOCOVrX7tfQN5/inEaMadDKNa1aIc8eH:Xl+1HCOVHtfQunka1KNaTc8eH

    Score
    10/10
    lummabootkitevasionpersistencestealer

    • Detect Lumma Stealer payload V4

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks