General

  • Target
    FоrtniteHack.rar
  • Size 606KB
  • Sample240528-swa3tabd49
  • SHA256 b9ad294c7046ebf0478fd26ead5c843ad085be2b75b384db7ce736b917bb0574
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • lumma

C2
  • https://horsedwollfedrwos.shop/api

  • https://patternapplauderw.shop/api

  • https://understanndtytonyguw.shop/api

  • https://considerrycurrentyws.shop/api

  • https://messtimetabledkolvk.shop/api

  • https://detailbaconroollyws.shop/api

  • https://deprivedrinkyfaiir.shop/api

  • https://relaxtionflouwerwi.shop/api

Targets

    • Target
      FоrtniteHack.rar
    • Size 606KB
    • SHA256 b9ad294c7046ebf0478fd26ead5c843ad085be2b75b384db7ce736b917bb0574
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      FоrtniteHack/FоrtniteHack.exe
    • Size 423KB
    • SHA256 22f96e32d657febaf4ebfb3a3f2e130bc81186411016f3dcd32c07ed28be0a91
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    • Target
      FоrtniteHack/libnettle-8.dll
    • Size 304KB
    • SHA256 1916c2878bdc6349d84d1c6c219a934926937fc23ceb77c97d88b945dc3d644a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      FоrtniteHack/libpng16-16.dll
    • Size 235KB
    • SHA256 74d4708664ee397fe2b5be139792cd188857e4b61d399b9b4d9562f140b46f0d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      FоrtniteHack/libraryfolder.vdf
    • Size 125B
    • SHA256 44d80569fa294e24ae57f189fe5a587f51e46e3ee2360b888b44d69b516c89b4
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      FоrtniteHack/options.txt
    • Size 4KB
    • SHA256 844b5770d897dce925425aa264669840a2c726c11a7dedffa5f079f67dfea52c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks