Overview

overview

10

Static

static

1

lSetup.exe

windows7-x64

5

lSetup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FuLL_lSetup_D0wnl0aded.zip

  • Size

    38.7MB

  • Sample

    240212-xgsfrscf72

  • MD5

    19d2f6e41aee61990cd7a50d92008d09

  • SHA1

    b564b3cbe3cc60ecd31157a36817670acf361c52

  • SHA256

    468f6d2d76ac4e2e840f63a6cd1df0e64a1c8cb575d1e0b3e9864d9fb7fd5212

  • SHA512

    cc0b5ab15372e8e8d5a6a4404fe8c6ef1f7b73e43eb30b878489b455b35d6d8111b59b75799563b148a82bd9ed31cbe22eec4af410612e8bc3e8f78dd4101796

  • SSDEEP

    786432:6nznYsY+9iYPx/ofznw+9ibADaznc4m+9iGNxlok:gQ+pp/oTw+KO+Tzlok

Score
10/10
lummastealer

Malware Config

Extracted

Family

lumma

C2

https://qualifiedbehaviorrykej.site/api

Targets

    • Target

      lSetup.exe

    • Size

      202KB

    • MD5

      64179e64675e822559cac6652298bdfc

    • SHA1

      cceed3b2441146762512918af7bf7f89fb055583

    • SHA256

      c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9

    • SHA512

      ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280

    • SSDEEP

      3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw

    Score
    10/10
    lummastealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks