Overview

overview

10

Static

static

3

!ŞetUp_51...up.exe

windows7-x64

1

!ŞetUp_51...up.exe

windows10-2004-x64

10

!ŞetUp_51...up.exe

windows11-21h2-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    !ŞetUp_51286--#PaSꞨKḙy#$$.zip
  • Size 4.1MB
  • Sample240704-yarfkaxeke
  • SHA256 0f94f6a5c219c17ba7c1c5d9be967e576c7a8f0e097a14706b13feed3aaafe7d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylummaexecutionspywarestealertrojan

Malware Config

Extracted

Family

  • lumma

C2

  • https://unwielldyzpwo.shop/api

Targets

    • Target
      !ŞetUp_51286--#PaSꞨKḙy#$$/Setup.exe
    • Size 1.1MB
    • SHA256 6a2d3876003f6c68f824df4f0033564d8c230716908ba2e6c06ea1dd6d5f98e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    amadeylummaexecutionspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks