lumma | hxxp://roundcube[.]custommarinesvcs[.]com/klounada[.]exe

General

Target

http://roundcube.custommarinesvcs.com/klounada.exe
Sample

240411-af5clsfa85

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://appliedgrandyjuiw.shop/api

https://birdpenallitysydw.shop/api

https://cinemaclinicttanwk.shop/api

https://disagreemenywyws.shop/api

https://speedparticipatewo.shop/api

https://fixturewordbakewos.shop/api

https://colorprioritytubbew.shop/api

https://abuselinenaidwjuew.shop/api

https://methodgreenglassdatw.shop/api

Targets

- Target
  
  http://roundcube.custommarinesvcs.com/klounada.exe
Score

10^/10

lumma stealer vmprotect
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Downloads MZ/PE file
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lumma Stealer

Downloads MZ/PE file

Executes dropped EXE

VMProtect packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1