General

  • Target

    d02318fd0e637750b60064faee9d75dfd2ad346600e8f52375296277cec530cf

  • Size

    372KB

  • Sample

    240329-ccnlssfa88

  • MD5

    6d355d3aeaec5673cae53ea50bcd1f39

  • SHA1

    58a8d0d4999ee4879a594bc970bf40eff09064d3

  • SHA256

    d02318fd0e637750b60064faee9d75dfd2ad346600e8f52375296277cec530cf

  • SHA512

    f233794e9858afb066b9c58fae904acb0bfa61956e4a8c4ec12008b820ba328a5549c59fa2fd24623c6b880242045f5d56bf69074e2d488972552992d980cd33

  • SSDEEP

    6144:Po7E88EC1qlMO0IODqwcPshU2M08zSh+ACFLb:PYE88EfpuGsK2b8ek

Malware Config

Extracted

Family

lumma

C2

https://brickbrothjorkyooe.shop/api

Targets

    • Target

      d02318fd0e637750b60064faee9d75dfd2ad346600e8f52375296277cec530cf

    • Size

      372KB

    • MD5

      6d355d3aeaec5673cae53ea50bcd1f39

    • SHA1

      58a8d0d4999ee4879a594bc970bf40eff09064d3

    • SHA256

      d02318fd0e637750b60064faee9d75dfd2ad346600e8f52375296277cec530cf

    • SHA512

      f233794e9858afb066b9c58fae904acb0bfa61956e4a8c4ec12008b820ba328a5549c59fa2fd24623c6b880242045f5d56bf69074e2d488972552992d980cd33

    • SSDEEP

      6144:Po7E88EC1qlMO0IODqwcPshU2M08zSh+ACFLb:PYE88EfpuGsK2b8ek

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks