General

  • Target

    InstallxWIN64.86+guide (extract.me).zip

  • Size

    15.5MB

  • Sample

    240311-xh4v7abb7t

  • MD5

    ca0930ef8500b1840955733f8995bf56

  • SHA1

    0405ed820b4bee97bdf6ec6942d654933f74f593

  • SHA256

    9bc340b9b7d93aed626be398a90b1977cf18a85c7c8d2c39efbf1d20a323cbc9

  • SHA512

    68b050b40bb6b7165b0a71e6bfeccda10a97eddeaa49d769ce5c7e45426a9bb68a088e8ecfd08a19eb6aa734a2649ad94c860fe8ef92aaffec782efaeed0056b

  • SSDEEP

    393216:9Y5k1LqfuSik5n6KR5WH4lYGP3dk+JY4PtgtPosEytegXw/:u5kOWk57xJY4PtuosEyQgXw/

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://diamondarrivallyowju.shop/api

https://associationokeo.shop/api

Targets

    • Target

      InstallxWIN64.86+guide (extract.me).zip

    • Size

      15.5MB

    • MD5

      ca0930ef8500b1840955733f8995bf56

    • SHA1

      0405ed820b4bee97bdf6ec6942d654933f74f593

    • SHA256

      9bc340b9b7d93aed626be398a90b1977cf18a85c7c8d2c39efbf1d20a323cbc9

    • SHA512

      68b050b40bb6b7165b0a71e6bfeccda10a97eddeaa49d769ce5c7e45426a9bb68a088e8ecfd08a19eb6aa734a2649ad94c860fe8ef92aaffec782efaeed0056b

    • SSDEEP

      393216:9Y5k1LqfuSik5n6KR5WH4lYGP3dk+JY4PtgtPosEytegXw/:u5kOWk57xJY4PtuosEyQgXw/

    Score
    10/10
    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks