General

  • Target

    cheeto.exe

  • Size

    2.5MB

  • Sample

    240505-slde7agf84

  • MD5

    4752ae9ded1b067272b532fb5fa71532

  • SHA1

    21d5d56e2c19ba80e1490ef848e3eea7cb19ce27

  • SHA256

    14b464786e4d4a374edbc1145068b183ca91dd49ced7f87852d56bdf85fdd8d6

  • SHA512

    2a16fab76366621f8455c6aa991d4d204c20d1b667ee6d39a4e674a1b4b6abd865e36e090ac5508f73a3185a078ff14e30c81461745f7b97decf7f3aa5751708

  • SSDEEP

    49152:vGAnxphqIyIc5uvBMbznLoktmx9OTcMw9xvunT6:3xnqbIc6MPnLfmKWv

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Targets

    • Target

      cheeto.exe

    • Size

      2.5MB

    • MD5

      4752ae9ded1b067272b532fb5fa71532

    • SHA1

      21d5d56e2c19ba80e1490ef848e3eea7cb19ce27

    • SHA256

      14b464786e4d4a374edbc1145068b183ca91dd49ced7f87852d56bdf85fdd8d6

    • SHA512

      2a16fab76366621f8455c6aa991d4d204c20d1b667ee6d39a4e674a1b4b6abd865e36e090ac5508f73a3185a078ff14e30c81461745f7b97decf7f3aa5751708

    • SSDEEP

      49152:vGAnxphqIyIc5uvBMbznLoktmx9OTcMw9xvunT6:3xnqbIc6MPnLfmKWv

    Score
    10/10
    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks