lumma | 64ac35ae2c9dc29efb1342f9748c02ba4edab217ececf060f2338e5069c7d5f5 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
64ac35ae2c9dc29efb1342f9748c02ba4edab217ececf060f2338e5069c7d5f5.zip
Size 50.5MB
Sample240618-vpgccswhjp
SHA256 64ac35ae2c9dc29efb1342f9748c02ba4edab217ececf060f2338e5069c7d5f5
MD5 a5d7db393d27a28ee75684eb57a657ef
SHA1 980d8ff3300ad6a5d343b7bb4a9292fac580fa59
SHA512 899c24c572829712710e19ef13a11c591a0fbf75f1e3f35f37015b208c8588bd5da21e803a84ce51eecdb68826bf2a39bdce44d6cbb7afea7c8c7c39fa45e921
SSDEEP 1572864:ZGtK4YVdiCsNoKaRRHhkwp3bdeJRWvx2jzBS1Y761t4wiw:ZGtK4YV3sGHhkwpyWvM30YO1Yw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma execution linux stealer upx

Malware Config

Extracted

Family

lumma

C2

https://employeedscratshj.shop/api
https://marathonbeedksow.shop/api
https://feighminoritsjda.shop/api
https://pleasurenarrowsdla.shop/api
https://falseaudiencekd.shop/api
https://raiseboltskdlwpow.shop/api
https://justifycanddidatewd.shop/api
https://strwawrunnygjwu.shop/api
https://richardflorespoew.shop/api

Targets

- Target
  DaBaby/ElConejoV1.exe
- Size 665KB
- SHA256 4b4126b38590bf32d620c0138732152c884270d17250132e33dee8278b8618d4
- MD5 ac0ec8db29b88d0c07466c71c4b6ce8c
- SHA1 9d31380fc2316e3e5ae6c1e0137146fdf3963a78
- SHA512 c5fda04217731d46856819defdac17790ce069b74fce3260cd8669ac557c51f4aae2d861e59620aca40995e106c4961e29d17139d20b9d19753ba85c40367eab
- SSDEEP 12288:FYjVU0m9IYFgS3kO/wGuOhFZEWCo5b8nYO5GMBzmFcB1tGdcl1YtQNALsxC3+5v4:F+m9IYFzVwOhFZEt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lumma stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  DaBaby/data/120/BouncyCastle.Crypto.dll
- Size 2.1MB
- SHA256 1985b85bb44be6c6eaf35e02ef11e23a890e809b8ec2e53210a4ad5a85b26c70
- MD5 3cf6bf0e0a27f3665edd6362d137e4cc
- SHA1 2016dd5e17331495901299eae9a5db48ccc8956f
- SHA512 72182dd7ce5fdaec8a79b65626e98f38eb8e74fa6129de08d54b3bb80867019b594082e2d9e583a788d81e69c12f7c6cd993d7d74a196bab72e68400c61e244f
- SSDEEP 49152:FFSSSusJVEDm2CNrmynmTF3P++3UEOkK59Vz4oukkb3KZ5:FFSSSusJeDm2WrmynmTF3m+E
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  DaBaby/data/120/Microsoft.Web.WebView2.Core.dll
- Size 392KB
- SHA256 5de4bab61b3af1c84730fbfa22da072253fc093705dd7ef2493be2bd0f7bef67
- MD5 0d11d388f401631ad6c06f218cb4fa08
- SHA1 e721f580561892d8191a91b19b168d58e2ed5280
- SHA512 133b010a866066eda795d4431ebcc90aa0b17095ecdbecc5433f686d9eae3fc43c276b1c60d331f0479b20c7422a93e37ef10c249e0d8e31d8f494f6118a6e4f
- SSDEEP 12288:DMFthrB3Bwi+uRdfe1+imQ9pRFZNIEIElxPrEIvLcgMwCepM1SVUGLQz3QsU41hZ:Dyr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  DaBaby/data/allonator/async/README.md
- Size 42KB
- SHA256 d0ee397ceb1814a74117d363934796392ea33448c4b3769579adbde82ebd2979
- MD5 c0900735f205ab79ef2d35762ee7d55c
- SHA1 f9a4700b8390398540777021cc858f4efb2b4b02
- SHA512 2d93ca179c74249f6102d351d7a1ab8c9256df3e6b6673bce6dbf550e7c8e0d4342b4622ad20bf4218a33122933c51ae30fd5154a3f79d68bbadb7240c844d2a
- SSDEEP 768:5C0P2+oDzN4oDCanhghioDYntyzjygOeSExFQ286HwceOB0mA1/ej:c0+lvM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral7 behavioral8
- Target
  DaBaby/data/allonator/async/lib/async.js
- Size 28KB
- SHA256 665d0187f6a7c44135a6b9fceb2a234f960893a22f3ed632e53b2fe934c3e6eb
- MD5 fe09e04d0bd97bdc821e560491b10231
- SHA1 b557301146872e38bde36f81efddb1aa284cf239
- SHA512 0b771cb35ecbe2b6d458c89175be62e1453e66a733a1cefddc040f23606b5be10b7125a45f6670ca192dc864ef80463fd0aaab52cdb077f321a2774c2b1a51a4
- SSDEEP 384:NUO49Xjf/vWe/vytfgR5y/mxyT7Z76kVSEiuka9sUJzRq1xdbiOvjiLogFEh6mbG:NUOLmMFoydoTa
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral10 behavioral9
- Target
  DaBaby/data/allonator/cli/README.md
- Size 6KB
- SHA256 de0da012d8edf04cfdc76c3d8a7486041f21042764f23cdcdf36976a8d649ccf
- MD5 7afbb633540a2aac2ef100840f86d423
- SHA1 9c6eb22494545b0c5f5c8a740fa2a8aa9625772c
- SHA512 9ee5fa4198105790d89b02961b8bc1e5e5793fda0eb770f74f7809bb9e72b4c3aaa3c1eb387948fba4f84e7f41008a179e5642016fb9cdfd20198237894dfbde
- SSDEEP 192:6g8GLtV/bS0JEuHN/4u/VDVK3HX5x8fbQHT7:6gJ/NaqN/4MDQ5i67
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral11 behavioral12
- Target
  DaBaby/data/allonator/cli/cli.js
- Size 35KB
- SHA256 4fcaca4a039994d020334ebde62c27f195112f8ea5b0abd6397b5493ed1858ab
- MD5 5a37c840e4b9d8433ea7c4d81c4d040f
- SHA1 bc9bc769044a9d47b64bce096d37ac9fbca62060
- SHA512 9da0f0238e6972e798c05a014c2f0ff1d26d6a41c6234cfdc3ac5e3c64df17d46ae1bb40a14c17ebbb1e45f6ec966e14502626e7998c24200fdda2ed419d11a4
- SSDEEP 768:3nMwWdVX0030UeThMRHI1n1TIrooJBpjvmWcin:3nMNI1n1TIXT
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral13 behavioral14
- Target
  DaBaby/data/allonator/cli/examples/cat.js
- Size 354B
- SHA256 1f54f1bae68712009064ba32086924b657e7b2d6ad7547d453b08158a267fa7f
- MD5 16ebf5ef635a9beca5e67f5c5f43c545
- SHA1 21ee32e9e1ea597b3854ff44fe1b5fd73e6ffae2
- SHA512 99700a63795be229f65749158c560e6d60382b2e8285ebf69885e1fa0df41482ca3e39c92e9d4512b53627d630446f774f7232e13ca2fc4893b33f7d7dc42e1a
- MD5 SHA1 SHA512
Score

3^/10
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  DaBaby/data/allonator/cli/examples/command.js
- Size 499B
- SHA256 5f765ef062e83aa93ae8bece7883e5af696315f2a98a10db3b7548f53ee3b07e
- MD5 ccf886c5ede744551b149c81ce1452ab
- SHA1 97e949cdcf85192ed05790370cce149373a0f0b4
- SHA512 ac642d74d914cf7f8510ac6366d6fb48ad3d40a8cced49659ffa55aefc4341420d207c656b0198e80f9744170b074b186466f484c344b8c3974ebcbbc3054321
- MD5 SHA1 SHA512
Score

3^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  DaBaby/data/allonator/cli/examples/echo.js
- Size 1KB
- SHA256 8e70dc3a05f8c1fcdcaa80bcd6b2a6cb4fef6f733b34546bf2f85fe70b3c1c60
- MD5 d33f449fff9a59ded665b6fa1f1db806
- SHA1 4410b4895da81164563a5a846c35526d11660025
- SHA512 1fe7f5e3812bccc619f672d12bf98ef211fdfc546b07ad7e9b98ad005ee1a089a8d8740f2ad71ccc2a325d9d27b9cf3500b49358a404674b759e55751a1307d3
- MD5 SHA1 SHA512
Score

3^/10
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  DaBaby/data/allonator/cli/examples/glob.js
- Size 162B
- SHA256 8e67aba8b0c9e22a053bbf65c6660cbc831c15ec4c77f61a17248153eec85c04
- MD5 5913fd09242969708a1f9849cbe3641f
- SHA1 51930b0d249f77cf0105e45da8e6731a5a3bf71a
- SHA512 48673338454723e00e9ffd2e09d2eeb81366085d0f1bee80833be812a5263aafe7476537738166ca4a589ba7aac4b0336342360d3d7896198c6df4be4d1fc3dd
- MD5 SHA1 SHA512
Score

3^/10
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  DaBaby/data/allonator/cli/examples/long_desc.js
- Size 949B
- SHA256 6539ba1d59e9e71909b5143b57445fc3a54097e4c45491dbfcf804dffd1360a6
- MD5 8c9d2115663950060f1398b68df76ba9
- SHA1 53873ef1df713e5893660a5a81728bd65bc8e55f
- SHA512 a3f82bfd5fd10a98367a66e9189b7c0503ad6bb95269755f51d6d3662d2cf961cd20a353c064ff9ceaf41610360315b2e4da02dde590f800b37bf3db9bbcf08f
- MD5 SHA1 SHA512
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32