General

  • Target

    $RD2LRHZ.exe

  • Size

    71.3MB

  • Sample

    240428-r6vdrsad7w

  • MD5

    1035fb8f30ba91c842559b5468f5d119

  • SHA1

    b260c17c7294252ce1b95906abfa7a5341d7d047

  • SHA256

    99271882f5d61c2e705f9cceb2bd5f911f104cfdb837ce7b14466ea62f825834

  • SHA512

    7a0763fe682a3728e5cb4a27e373bf29bac172ac6d9332775394d2bd7671680f0f19385bb95b6d84b14a3fd88b84e91c8e11a592649d5fd31eebe33c76708017

  • SSDEEP

    393216:pRQU5PZcx+p4C7tvgDwB1JshHA52LpXopwswkV8:pRn5Pix+yDwqa5WlfswkV8

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://bowelunitrydoorsko.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Targets

    • Target

      $RD2LRHZ.exe

    • Size

      71.3MB

    • MD5

      1035fb8f30ba91c842559b5468f5d119

    • SHA1

      b260c17c7294252ce1b95906abfa7a5341d7d047

    • SHA256

      99271882f5d61c2e705f9cceb2bd5f911f104cfdb837ce7b14466ea62f825834

    • SHA512

      7a0763fe682a3728e5cb4a27e373bf29bac172ac6d9332775394d2bd7671680f0f19385bb95b6d84b14a3fd88b84e91c8e11a592649d5fd31eebe33c76708017

    • SSDEEP

      393216:pRQU5PZcx+p4C7tvgDwB1JshHA52LpXopwswkV8:pRn5Pix+yDwqa5WlfswkV8

    Score
    10/10
    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks