Overview

overview

10

Static

static

3

f61712dccc...5a.exe

windows7-x64

5

f61712dccc...5a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a.exe

  • Size

    3.6MB

  • Sample

    240615-c66z8szgmm

  • MD5

    c28a2d0a008788b49690b333d501e3f3

  • SHA1

    6a25fdb8613db00b09d4d6e1ad302c20c7f7e2c4

  • SHA256

    f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a

  • SHA512

    455923a63e60b6079d7e0af2bfae5f922b205d024def456ae95158ef1bfcdbc4f56e24b4421a2203f4618d0ea29e229e331c7ee0d7881ee8ebac83fa72f5d788

  • SSDEEP

    49152:U1oQZv/+4a3xWcOZL/Glf1jSGS/P58ahntq7d59ZFVcjAflZWExUBv33E8ep50:U1fv/+R3sla6/P58ahn8zFVA6ZWRU95

Score
10/10
lummastealer

Malware Config

Extracted

Family

lumma

C2

https://willingyhollowsk.shop/api

https://distincttangyflippan.shop/api

https://macabrecondfucews.shop/api

https://greentastellesqwm.shop/api

https://stickyyummyskiwffe.shop/api

https://sturdyregularrmsnhw.shop/api

https://lamentablegapingkwaq.shop/api

https://innerverdanytiresw.shop/api

https://standingcomperewhitwo.shop/api

Targets

    • Target

      f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a.exe

    • Size

      3.6MB

    • MD5

      c28a2d0a008788b49690b333d501e3f3

    • SHA1

      6a25fdb8613db00b09d4d6e1ad302c20c7f7e2c4

    • SHA256

      f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a

    • SHA512

      455923a63e60b6079d7e0af2bfae5f922b205d024def456ae95158ef1bfcdbc4f56e24b4421a2203f4618d0ea29e229e331c7ee0d7881ee8ebac83fa72f5d788

    • SSDEEP

      49152:U1oQZv/+4a3xWcOZL/Glf1jSGS/P58ahntq7d59ZFVcjAflZWExUBv33E8ep50:U1fv/+R3sla6/P58ahn8zFVA6ZWRU95

    Score
    10/10
    lummastealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks