Overview

overview

10

Static

static

1

PASS-1234.exe

windows7-x64

3

PASS-1234.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PASS-1234.exe

  • Size

    1.2MB

  • Sample

    240421-hvxv3sdg52

  • MD5

    91a6507a51ddcf98f542e89c58b9a17e

  • SHA1

    870a96273698fc67cf145a7601fc3892671eea22

  • SHA256

    aca438e378d0fd7abdb1fc1f7cc9acdc279dbd399fda98f8078a99a4a24e537a

  • SHA512

    cdc5aa3b28e69e119c1415ce760d6cd6633eb5ab98834d609ec198b212614ad49d1f9e5c11f44507522eaf7b1bf39d5d9d20064df5259a358951e15f05154e48

  • SSDEEP

    24576:zkeQ/Joxh1oVZM8YWmwZ+Y3DkUU78T0KPTXBsn1F9/GAApP1aqNt+:Xxh1oVZMY31snDNrABYqS

Score
10/10
lummastealer

Malware Config

Extracted

Family

lumma

C2

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Targets

    • Target

      PASS-1234.exe

    • Size

      1.2MB

    • MD5

      91a6507a51ddcf98f542e89c58b9a17e

    • SHA1

      870a96273698fc67cf145a7601fc3892671eea22

    • SHA256

      aca438e378d0fd7abdb1fc1f7cc9acdc279dbd399fda98f8078a99a4a24e537a

    • SHA512

      cdc5aa3b28e69e119c1415ce760d6cd6633eb5ab98834d609ec198b212614ad49d1f9e5c11f44507522eaf7b1bf39d5d9d20064df5259a358951e15f05154e48

    • SSDEEP

      24576:zkeQ/Joxh1oVZM8YWmwZ+Y3DkUU78T0KPTXBsn1F9/GAApP1aqNt+:Xxh1oVZMY31snDNrABYqS

    Score
    10/10
    lummastealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks