lumma | 8c9f417cc07060056a707d847258a7a6a98e0ef6a16cb1243222c235d79c86bf | Triage

Submit
Reports

Overview

overview

Static

static

3

ff9c2ce33f...18.exe

windows7-x64

ff9c2ce33f...18.exe

windows10-2004-x64

Sharing

General

Target

ff9c2ce33fce1585aa1ff20145555761_JaffaCakes118
Size

227KB
Sample

240421-s3lswsec93
MD5

ff9c2ce33fce1585aa1ff20145555761
SHA1

0a69962fd393fb450a81b557af000bcc9d8b1e25
SHA256

8c9f417cc07060056a707d847258a7a6a98e0ef6a16cb1243222c235d79c86bf
SHA512

7572f57ee2ed16996df52c8c70d7e01cfdac1cca15e86334a7f78d370fc6fb5ac3efca4e082e82a5073fcbd4acf116d0e619a3a3d090129e5eeee328ddd0338a
SSDEEP

6144:qoEdkmu85Dq+3qM3W7tfQN5/inEaMadDKNa1aILk71:gkmDN6M3atfQunka1KNaTgJ

Score

10^/10

lumma bootkit evasion persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ff9c2ce33fce1585aa1ff20145555761_JaffaCakes118.exe

Resource

win7-20231129-en

lumma bootkit evasion persistence stealer

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

ff9c2ce33fce1585aa1ff20145555761_JaffaCakes118.exe

Resource

win10v2004-20240412-en

lumma evasion stealer

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  ff9c2ce33fce1585aa1ff20145555761_JaffaCakes118
- Size
  
  227KB
- MD5
  
  ff9c2ce33fce1585aa1ff20145555761
- SHA1
  
  0a69962fd393fb450a81b557af000bcc9d8b1e25
- SHA256
  
  8c9f417cc07060056a707d847258a7a6a98e0ef6a16cb1243222c235d79c86bf
- SHA512
  
  7572f57ee2ed16996df52c8c70d7e01cfdac1cca15e86334a7f78d370fc6fb5ac3efca4e082e82a5073fcbd4acf116d0e619a3a3d090129e5eeee328ddd0338a
- SSDEEP
  
  6144:qoEdkmu85Dq+3qM3W7tfQN5/inEaMadDKNa1aILk71:gkmDN6M3atfQunka1KNaTgJ
Score

10^/10

lumma bootkit evasion persistence stealer
- Detect Lumma Stealer payload V4
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Modifies security service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

lummabootkitevasionpersistencestealer

behavioral2

lummaevasionstealer

© 2018-2024

Terms | Privacy