lumma | 2ba315ff4d5e4d85b85759fffad1152c3388a8e761c32dfde8c72fff1b96bfe5

Resubmissions

17/04/2024, 07:33

240417-jdvvtsae3110

17/04/2024, 06:33

240417-ha7jsahe7s10

Sharing

Copy URL Twitter E-mail

General

Target
2ba315ff4d5e4d85b85759fffad1152c3388a8e761c32dfde8c72fff1b96bfe5.zip
Size 23.4MB
Sample240417-ha7jsahe7s
SHA256 2ba315ff4d5e4d85b85759fffad1152c3388a8e761c32dfde8c72fff1b96bfe5
MD5 e4461e16ebd9b9c4a34a754c9962dc5e
SHA1 468a491e227d3ca2be95a0f37bc6a4f2a13c40b4
SHA512 e1a8deadddb2664061be077fd1a7a45af19453e4ab07e2b3e69748355b881c285c46b98087b954abd5cf88f497bfe3fcbcd014f32c2c79062919b3ab63fde149
SSDEEP 393216:uD8VuUVsghRGviy2dAG8stFbrI8gxD9AfwBmJxzowCl7QkhHZtAOfaa6n3Jp+NCd:uDBIJ4iy2d3txrI93azanhQOun5T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lumma

https://explocommisiowsa.shop/api
https://entitlementappwo.shop/api
https://economicscreateojsu.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://bordersoarmanusjuw.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api

Targets

- Target
  Resource/AppXRuntime.admx
- Size 3KB
- SHA256 5afc969e4212a6511f307385c99b8868e8c873183dc271bbb95ba571b24eb53e
- MD5 88d794ea092ef395433cfa321d06e5e4
- SHA1 f1f7c7dfbd04ac5a92cbde88bd4f087781d63c40
- SHA512 ebb770102b8202de4bb7319cbc2cda860e4de5d1e95f0fbef4d4890aa2b22cd48cf73909d028a37b507926b4fad573716fba16e50b8f9eca8d5feab00ac17cca
- MD5 SHA1 SHA512
Score

1^/10
behavioral1
- Target
  Resource/AuditSettings.admx
- Size 1KB
- SHA256 ebac316580540b7ee8e399f890470527e456f2c6a103fcc899f4b2442d8e69f7
- MD5 9a36a7410b4ef98b36da553e050b9788
- SHA1 4ba6e5225a7c5daf30f4947b9288b708e8e557e8
- SHA512 7cd81f2bedde51bca3a1f5a0889870be71ef521e5c331f1c8ba4ce97bf604adfff6cafa0fe707ed55df62bc340c45baa189e3d07f20a466ee7254f3c6abe6b74
- MD5 SHA1 SHA512
Score

1^/10
behavioral2
- Target
  Resource/TaskScheduler.admx
- Size 5KB
- SHA256 7d908e972efd3696084d60135a685b96553ef215a181db900b70a2a5320ddc22
- MD5 81f5d01fcc855eaa4e2195a41354cf43
- SHA1 e671548f1be0e041848387e29c886df88dec47eb
- SHA512 7c8573db0f1a821b642294a5848ba5ab67a71a7b944a19a9c79ac38782849e4e6b68c8036e01c9835ad931b79a268513fd662216689e39b321f956624bb14bdf
- SSDEEP 96:QeD/mDm6ovKnKD5E/u8T/u8v/R8C/R8T/R82/R83/t8a/t8s/u8b/u8n/x8m/x8f:vYnuququURXRQRjR0tnt7uquuxFxtmEK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  Resource/TerminalServer-Server.admx
- Size 18KB
- SHA256 975ce51517cd3ef6c7d8717f9966680bbc127efb3eb18d7f7f17e06855702fd5
- MD5 ff63c2011f5455dfb88bf4e55e0c41bc
- SHA1 1120c97538348f5f9eb49c055d83c6af77390c76
- SHA512 6799ec3efa857d9a88fc7479e7d1f6148304baab376e5e693bb9d9b44112fdf89d13e75d7becabf2efce978f77bb9206e8d09b65bf890a6d54680628acd8c0ef
- SSDEEP 384:+QqnQsuy9CsODa4a4Ym79b+vYm79b+VLdHEEHMgec+8yTJh67m3exgb:+QqnFJzjwjRdHEEHMtHfv6auWb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral4
- Target
  Resource/TerminalServer.admx
- Size 91KB
- SHA256 87e28f940d8868d0460fd3372cce184cf8145bcffa50f70b5b1c2713abb70c15
- MD5 eaa1a71d350b56d3edea127911adc959
- SHA1 8d2a21120ac2b4a9eec8de3cb4531d3da9c123f0
- SHA512 8247a68b5a227170046b48f23f8980bd1ae96bd6143b72e2e77105c4f0b93c9efd4ebed2fd9d01f1f964f307aaa44d668b327fb1e1be255da78ed04566c401af
- SSDEEP 1536:PsieUgOROb+/bjuAGxejp/ajqG5g7DgMK0KaKoWdW+Q5AYk66QhqyRpl8vmdeSv5:PsieUgO/5qyRpj3gY3vsw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5
- Target
  Resource/inetres.admx
- Size 1.6MB
- SHA256 5b9d8f4735a3bfc022542f617c2fd77dbe4b0bfbb506d51e1ed0adf896155356
- MD5 39f0d8dbbe07170c55ff82ff6e0f137e
- SHA1 9968c17e869250de0bfb2353362ff981b1152b9c
- SHA512 9f27dd0e757cc4b8a6c3e83e4044068440547380fa91d1580b00f1b62f07822376744ee65bb5eafddc4a35b6048b8f32209d00766f88bf09df9847053c1df3c3
- SSDEEP 3072:0wQADKm6VNTp6qpxFwFVSl9t4VpR+4Mlu8ROYg1V:eWPq3yrvMD8Yg1V
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  Resource/kdc.admx
- Size 4KB
- SHA256 518b39ad75aec993b9e48733f1b3c38ef131c94b240abc2449c0573eddca5d2a
- MD5 2af259c23535c7d28fe3ddb905946f29
- SHA1 e73fc86257a2cd49de99072d2eaa19f143854bde
- SHA512 c9828fb477511b6986a830cc7bcf1b2405ecb35970d5cc411ed558f1a300603bada8008f1a7cd2f55ebcef2dfa9b92f3204e5ca5827c68f585eb9573e63443d8
- SSDEEP 96:QeD/mDQIovKnK75DmSxdIS9MGweOS11IS5Gw0/M1CScGwiSQo1P1SFAG:vYLAd3tCef1TP00J8jRyl
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7
- Target
  Resource/msched.admx
- Size 2KB
- SHA256 295ed67096dff66228e1069fe6f6435f829a7172983c49906f7ffd4a3e210cc0
- MD5 96d22e893dfb610e2fcbf06487747388
- SHA1 99a792caa380276f43687b2ac36f42585d642c77
- SHA512 2bf1485d0e5907eab1d472364c35ba7eaf51f4a9cd3ddae64770fdcc3c8b2729a5d2e0684d058df7f8b9c5015ebdf7ffbc65c1a7fd9f402615164f66a40ea27c
- MD5 SHA1 SHA512
Score

1^/10
behavioral8
- Target
  Resource/nca.admx
- Size 5KB
- SHA256 3634538de95d6878f6022798836e0b04f4294812f8944c3ee615d38de01659cd
- MD5 1b66bd19c277cdaba812478de7c0bab1
- SHA1 95c48b9a1f7b3a91892a2d51ff912eab778d36f0
- SHA512 e54dc3944a7baec47a99ea0969131b9c6107ca2a1f2b0d2529e2ce14df80ab051484bf2f0f029fd6f104ffc3de1f350db5ddb939f6a720716fa7afeeeca2e1cd
- SSDEEP 96:QHHoWKnKKX2mewF99KQjews9ABKC9AyM9dSE91ysewt4xnOYgw5XEqaE87wICRl:QnYbD9BMkrSrn+xnzBEqtRl
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral9
- Target
  Resource/pca.admx
- Size 9KB
- SHA256 13a96dcba9cc049dbeeba890c8d4845cddf7d9307395ffc98f0c8a4faa0b9e71
- MD5 0abfe09e86cbaf074c2a6efc603720eb
- SHA1 9291fd7531e839342a0a010589e637b15d6c0ab6
- SHA512 05132b9e0ffb36b9fd964a42878997953ebdb83d2357d5d9887992d4c5c445d4a4132d754f2820a336b48834c72b7c42af09be24e6be4e52db059464cf3dd074
- SSDEEP 192:vYpu2Jx6X6jJLcVhkGLJVhwhLMVhcuufLKhcwryr4:AP6X6dLcVhvLJVhoLMVh4fLKhjryr4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10
- Target
  Resource/sdiageng.admx
- Size 2KB
- SHA256 872a02debed178f5332f016c2dda59f92eb32b624264334c360fd996a21a5536
- MD5 8bce4667d0c7ef7b8c2a67ad0c7cb0fb
- SHA1 34b32874284f5b21e170053c609e6996b8f11896
- SHA512 b7006f163bcf35f04fd6cb19d2a62176130f4538e3bc33fde08738783c65e912b0f5dec2bf87bd8c1c1fdc9cf6b042dd8122250dfef5c2976372a3bc195d6be7
- MD5 SHA1 SHA512
Score

3^/10
behavioral11
- Target
  Resource/srm-fci.admx
- Size 3KB
- SHA256 89a43bc6033180bef0e9c8a57b83182050ff2ef124713a9a00a187a5547233ff
- MD5 b1433d2594dfaceb0231a7b0288176e9
- SHA1 676d71632b5504364a46cde61f31580fe63086c5
- SHA512 30ef93693179914bb116138d80768650d5fbb83e7c78ebb44aa3e533658427007c82338cf019fc5e2e2d96fa7a2a695a21dde6ba185f82c6ef419ac6af064c4e
- MD5 SHA1 SHA512
Score

3^/10
behavioral12
- Target
  Resource/tcpip.admx
- Size 10KB
- SHA256 f5b4275e4adae51ead17b66f2bd72f661305d6965df25d29991d3710bd5c6b97
- MD5 27e7fa51d11cefb156fd72630a31fd9b
- SHA1 ff4b5f9dd518380da96064d971b613c350c00698
- SHA512 24fc6febcb81b88f50e9ffee9b69f1f30a0fa3cc1b0e1c1d5c28e72b4804c9e55532d5550b4096a5c7772645b3c45fcadc3be3c352c2efee7d77b7cfcc13f6e6
- SSDEEP 192:sYXWk9FwEvOkUFPEWFF6wkCdgTKUQuQXgfkm8kveXDXRNm:gk7wEvOkgPEWFF6wkmgTKUQuQXgfkm8+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  Resource/wlansvc.admx
- Size 1KB
- SHA256 683522392f9efbf5aa9ec0d494cc77f3b430bcb2aa93cda36002368ba9744b30
- MD5 5e91ab87cfcfaff4ee2df1de9f56aec9
- SHA1 5e1cc79f0c019a2707b0a8c71016a0a29c2e0bf6
- SHA512 3a4aff0419f8a0b1a92170cfd71bc1d06d40b4410b350d4071aedcbf9bab095fe8d0ea0d83bfa821d8ee9649c22a3786e29e60f0b8ad363ad04fc6a8a721d23c
- MD5 SHA1 SHA512
Score

1^/10
behavioral14
- Target
  Resource/wwansvc.admx
- Size 2KB
- SHA256 a9e3a282b770c3a69078f3f87ce3251aee637a6458874f0f813dbca51f35d70b
- MD5 d678fa20d6119e611d2866830fe02668
- SHA1 93412a379b31d0b26a2a9fd3c2726ee42dc52ee3
- SHA512 f6133cac994b513ecb05c8cf8009d05b3c4163b08c9eeeea728a0634b3620085edd479be227b351e77249f7486079e445949c26b6f9e8577dcda8ef753c5ee0a
- MD5 SHA1 SHA512
Score

1^/10
behavioral15
- Target
  Setup.exe
- Size 2.3MB
- SHA256 26a24d3b0206c6808615c7049859c2fe62c4dcd87e7858be40ae8112b0482616
- MD5 5d52ef45b6e5bf144307a84c2af1581b
- SHA1 414a899ec327d4a9daa53983544245b209f25142
- SHA512 458f47c1e4ccf41edaacc57abb663ee77ca098fffc596fad941bbdea67653aeabc79b34d607078b9ee5adb45614e26f5c28a09e8faf9532081fdd5dec9ac3c48
- SSDEEP 49152:DzO+g39FbI0eQf/Z3CarWedoYAmXviDTMtT2wkqN5K:DzO19Fnf/hdoYAm9ZkqN5K
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lumma stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Suspicious use of SetThreadContext
behavioral16
- Target
  cufflink.vcf
- Size 65KB
- SHA256 01bafab73b1e16db84600aea8415391bd5acd9e36d683fa5eabcda9ed386d4d0
- MD5 18857476bff1ae29423ec3c8ae14f8ee
- SHA1 b4bae6186d50bbd37d24846f12e6a9d323e1c11b
- SHA512 f8fd5ef9884fbf819a8fab8f039487116586b4d0c6e0935cc5ed2bad10f124b40fcb1c5234961ef41cada5619124a4f6f3cfe43f60657224db8e0814e79a3594
- SSDEEP 1536:lmu/ThG9QpG46sYBkdXlf5f+0bby4vOkkFR:kyhuQo46pBKf+0bbBvhkFR
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17
- Target
  madbasic_.bpl
- Size 210KB
- SHA256 7826395127e791a883359ea81308174700da0af8052cc9853b19fd29c2e4badb
- MD5 e03a0056e75d3a5707ba199bc2ea701f
- SHA1 bf40ab316e65eb17a58e70a3f0ca8426f44f5bef
- SHA512 b0a3cfb6b34832f048fe0fc70c6fa76ae16a2cacda930f6529a83a967d6e8de1c69b93e0de3dc2126c5385d85e814687e695a0a4131399a69633141cad98da2a
- SSDEEP 6144:6N/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/FrfGx:JqeM/k4qR5L5e5+53WulZGx
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  maddisAsm_.bpl
- Size 63KB
- SHA256 475f7cdffd8ed4d6f52bd98ae2bb684f1c923a1be2a692757a9af788a39b1d87
- MD5 ef3b47b2ea3884914c13c778ff29eb5b
- SHA1 dc2b1fa7c7547d8f1ad3f20f9060f7bc686118e0
- SHA512 9648d951d8d3640436c8029fd0f06786f7ff8f52191cd6959569c87868bb6c40ac8c7e495c09377a8a5c85e8d3942551c37eb84e916b5c16327d8d43a167820e
- SSDEEP 1536:eNy3eqMne0sXB0IWtCLwEJhY0w1K7fixStj7wyis:CqMnfIB04LwEJhY0w1K7zzj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19
- Target
  madexcept_.bpl
- Size 436KB
- SHA256 df97c577196106abb67e56a05db22731db51fc8cc86b90c0dd4b16e43ae97ce7
- MD5 08c34e7491d9fa27ef9e70d6f31934a8
- SHA1 d2a7084f7108717102831190370d5052b519a2a9
- SHA512 2ef1882c5b638aa6b2882c313624d493cc3b7493622af16e91a113720eca4f4f24e8e378e6fa07b210e86896751ea14505b892d5042202adfc3374cd8636264e
- SSDEEP 6144:vlA649EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNpa4/n2g:vl74ut30F8slzYlQcW/jd++2nJ7R2g
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20
- Target
  quin.doc
- Size 779KB
- SHA256 4e5a146637b0bbb3ae7c6d24c2afe979e2cee2ae1df61ed6225d68cf7e4ac3ec
- MD5 d6e4657a83e3388fbd9b1b33e2aa868a
- SHA1 87473eb0b2bfd1c84c8e605655a5d7e1b9861914
- SHA512 30857ba44582505ef2b0909a476d2c51013066ea207b70a8b6f47e1a13459a69edcc02da2fb85e3034d01f38edf66f15fbf3056f2ac9ad93637bc081106dede8
- SSDEEP 12288:/NGBdMAYY8b1JNKu17yD8T4Xf7gMH8k+7JP5Hmk8MBH5ldI6lwp63/zDGm5z:gHuB7yA4P7lcz7t9mk8MRacwUXF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21
- Target
  resources.pak
- Size 4.9MB
- SHA256 11d0f55c105883d203137a87a610ba793299dc4774fd6d8b3a86666a2c337041
- MD5 df15387bf046715cc592a690da33e4b1
- SHA1 ad93b08dff82cbd894f6a0a9733c70d7e564113d
- SHA512 71244553d7b1b559fcaaa059622c340d22148bd5324fa3f6730d37322025dbfe5e853948b49b91db6022a25bca4ddbab8fe6ee1522a461963dfba04a7c93d69a
- SSDEEP 98304:b6zN1Kt66I0+1Yk93pPVrXh188CYCUrwr1ISgMRQK8nXCpGm5vEybt:+zjKt66bGVrhm8hCUkrGsyCV5vXbt
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral22
- Target
  rtl120.bpl
- Size 1.1MB
- SHA256 7ed5369fcf0283ea18974c43dbff80e6006b155b76da7c72fa9619eb03f54cef
- MD5 1681f93e11a7ed23612a55bcef7f1023
- SHA1 9b378bbdb287ebd7596944bce36b6156caa9ff7d
- SHA512 726e8f58648a6abaf1f2d5bebcf28c1d8320551a3b6e7eef0cf8d99f9ef941e30e7004c24c98e9b5e931a86128d26de7decba202390665a005e972dcbe87ab93
- SSDEEP 24576:3bhz5FWbA1msvIRzM7Rk5JZzSQ4+Is2D9Tx0gboN:Q2hTKgboN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23
- Target
  vcl120.bpl
- Size 1.9MB
- SHA256 713c21d009000d504d9bcf3ce95d50e74d3933083783de144db0a16e2425ebcc
- MD5 13a2734bb2249010514386ebc856b8da
- SHA1 8f6e3b30f30a5bba9bc6baaf8f440e085a6a568a
- SHA512 2f108436fc1a03591802ff6b8c6ac1de1c0388b2a2a6f8839c10b5f0ec06b66775f261da4ace05fa367eb46b5be533949c092e113fe1270adedb9cb8c34ba2dd
- SSDEEP 24576:O2gt8PRUMggrgN/5tWw+eNVEXZB5SOCwhuuYY8RPyS9YEPI5yz6I:ORSf0Ww+NpPSyzYY8c8YEPI4+I
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  vclx120.bpl
- Size 222KB
- SHA256 2feec33d1e3f3d69c717f4528b8f7f5c030caae6fb37c2100cb0b5341367d053
- MD5 3cb8f7606940c9b51c45ebaeb84af728
- SHA1 7f33a8b5f8f7210bd93b330c5e27a1e70b22f57b
- SHA512 7559cdf6c8dbea052242f3b8129979f7d2d283f84040f1d68ae10438548072715a56a5af88b8562aeea7143194e7c5bddac3fdb01ded411a0b1cac9f0c6eef3f
- SSDEEP 3072:K4af8kXL6nX0YXjvkWQ5vYhbNkWPFOEJ8YZbjeTl0Y25zFgYBzRKy6sB65avEtAA:baf8kLWL7Xov8bNxdOmrfgYmHA6h
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral25
- Target
  x64/Templates/TemplateCorreoCliente.htm
- Size 2KB
- SHA256 e17621dc67919e53a0d1be6a03fa0d97f01c8932f8d8912d556327e620310432
- MD5 ce4c1f3ba9e690c4119e8ed39aa8eb78
- SHA1 dc2da00c92b51431c01c5e598de4665c9989e856
- SHA512 daf95e6329b060fe230096fc7a594cf0a13801e2dcf9869affa5530a2d03bf6c0dd2d9340be5c312b82d41dad48057f86811a23b23fba93b0dc9a478986ac4ef
- MD5 SHA1 SHA512
Score

1^/10
behavioral26
- Target
  x64/plugins/MahApps.Metro.IconPacks.PixelartIcons.dll
- Size 135KB
- SHA256 188f508445a69ddfcce1de0fcb1280bac9b2dcf49f9ae62ed31bee58947f0cab
- MD5 65e9ecaf0c66785a4b0b2147683d258b
- SHA1 b718931af23a815acb1ab3ff72cccd5de7e40b21
- SHA512 fe2866a6d25843ce60cb0898efb721485b7b0228c4525f7cca21f5d76bc08a76f5ceb0787535349e0a1fae8c5cd8374ef75066225b0122a446099dbf815b418c
- SSDEEP 1536:MYFuVW7Yoq20bnSvvlzBjOJhueSKki6ZoDci0mLLVQSR8tF4HO:MYFug9wSnBQueSKki6ZoumfcF4HO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27
- Target
  x64/ripp.rf
- Size 40KB
- SHA256 8e7206850a4b3c6a3f53739c31e78f7916f3547f392f69e6b475e671244c437d
- MD5 ca57ccdabc7df2e63aa1cb548c59686f
- SHA1 1a4037a55b55b9df0e81e9f4a1ecc832aa721142
- SHA512 1c514ffcf33c688802cd78997502e51c9551bee125f5dc1942803374b426476d11eec24086a718b81e7c3c4149a77a7a00f7ee5be944a780b58c9625f76824fd
- SSDEEP 384:H3NXAdTmGbOiXQ/Y4GO70pzE2NeeamkdQPJ/q184kWojlWHl70GftpBjvlXM+Mcj:XAKGZXY7B2YmkyJ/M8wGijXRMBhtydr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28
- Target
  x64/tipa.png
- Size 84KB
- SHA256 db21c3e3322133179a45375e74b41175bd34e54bec2ab96859194b58567adce9
- MD5 ca707040296e42063a7805e363b3e187
- SHA1 734e24fe47e85b9e875adb152e7b721176bdfea6
- SHA512 dfface550e45a5a09f5d90bd6c2d95ea25e50e588a20c72e058a40990041c3066626855c9c6636a134d9f6de9c72a89f6c7e16c5df7fae6436d9d62539ea3e9a
- SSDEEP 1536:fGU7EasoTzjdljE5T48Kar+eEXBxKFZ9s8nsQBWvf5Lbz:r7LskdljgZx+ZXBA9XBWvf5/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29
- Target
  x64/upd.dll
- Size 1.4MB
- SHA256 d26a7f2d4f3521827201e6cdcd296f132c7d18c3a1ce70c24b423300cff326fe
- MD5 31fee2c73b8d2a8ec979775cd5f5ced7
- SHA1 39182a68bc0c1c07d3ddc47cd69fe3692dbac834
- SHA512 db51b602a8675641bc3a0a980a197243787ed12f5e0619cb1d390c91193d7e3447e3e86e2321c3ea273c6732b356003a249241d7d8a5699931810e5a35d5c650
- SSDEEP 24576:kL/7n6lbcC8oblv1zj1SqdAGFQZIxvC45UJoe1Z:E6+C8o5tzjYq+ZIxL5UJoeL
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

bootkit discovery persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral30
- Target
  x64/zlib.dll
- Size 217KB
- SHA256 c0d4ca1f64d8b0420424f6ad03daa9a2843f3834e3a1fb1dbf2b55bcf9f58be8
- MD5 6b223738cd91701a30f579256fd06638
- SHA1 4f334a19caabe13ccb270cf2fa7018b914c83647
- SHA512 f037382569a9bcf0e188661d6e73e22a2ad59298f7c22c0f04b4a9daddc45c20f8da0304cdf37bb298e338dfc9d556495679e42b0a371b67f7c270df1869619b
- SSDEEP 6144:U+bfb9iR9O1bzgQdR5cMCVFZSQVKWdF91xeuyJPAOtUsCU:Uou9O1bzgQdkTPlFwuyJPosCU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31
- Target
  8866 Passwords.txt
- Size 39B
- SHA256 79301f8f91cb01e28ae449ad90b080bba81fd1faaff1a31f713e32d221b011c8
- MD5 a9f0f60ccc841224d3ec9e595f6ca706
- SHA1 8931d58f3fb4317c52907ee4f3309e79c876bf48
- SHA512 a6faf99c5002b6d8bdafefa9b2a33c3e900f377398dc540d0b3c389d06e381ce3de7fc6c7bccd335d92ee92b55bc96c071b35630298db53b9276ac518a1eab0d
- MD5 SHA1 SHA512
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Lumma Stealer

Suspicious use of SetThreadContext

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32