Overview

overview

10

Static

static

10

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1

  • Size

    472KB

  • Sample

    240506-25t2qafe4z

  • MD5

    46c72d686c836f3c97ce18b81b0d9864

  • SHA1

    fdadd2e3cd971cd9fffb3de0f4a69ed0f77ae4a5

  • SHA256

    deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1

  • SHA512

    1ab8c8967155913c5dd0e2853d663bb096571062680de246fdda370947f7b6c3d2f44b85be97b821c630a4a42b3990d78601615737c3ced1418c9ccf18611208

  • SSDEEP

    12288:ub3IzlSJCfjT1CDcLfSsYxolZ0B3HpCO00N4:ub3gMMT1iqSRxovg3HE+4

Score
10/10
lummazgratratstealer

Malware Config

Extracted

Family

lumma

C2

https://miniaturefinerninewjs.shop/api

https://acceptabledcooeprs.shop/api

https://obsceneclassyjuwks.shop/api

https://zippyfinickysofwps.shop/api

https://plaintediousidowsko.shop/api

https://sweetsquarediaslw.shop/api

https://holicisticscrarws.shop/api

https://boredimperissvieos.shop/api

Targets

    • Target

      deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1

    • Size

      472KB

    • MD5

      46c72d686c836f3c97ce18b81b0d9864

    • SHA1

      fdadd2e3cd971cd9fffb3de0f4a69ed0f77ae4a5

    • SHA256

      deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1

    • SHA512

      1ab8c8967155913c5dd0e2853d663bb096571062680de246fdda370947f7b6c3d2f44b85be97b821c630a4a42b3990d78601615737c3ced1418c9ccf18611208

    • SSDEEP

      12288:ub3IzlSJCfjT1CDcLfSsYxolZ0B3HpCO00N4:ub3gMMT1iqSRxovg3HE+4

    Score
    10/10
    zgratratlummastealer

    • Detect ZGRat V1

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks