General

  • Target

    https://objects.githubusercontent.com/github-production-release-asset-2e65be/836419795/ee16c3b6-c75d-4b90-bf0e-af91d4d12bbf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240731%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240731T214729Z&X-Amz-Expires=300&X-Amz-Signature=1f4b117e624c5a2e64059802976f7210ab9e0f126a45801dfc884c14cf7b55ee&X-Amz-SignedHeaders=host&actor_id=117325187&key_id=0&repo_id=836419795&response-content-disposition=attachment%3B%20filename%3DSolaraInjector.rar&response-content-type=application%2Foctet-stream

  • Sample

    240731-1p2wyszdne

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://demandlinzei.shop/api

https://applyzxcksdia.shop/api

https://replacedoxcjzp.shop/api

https://declaredczxi.shop/api

https://catchddkxozvp.shop/api

https://arriveoxpzxo.shop/api

https://contemplateodszsv.shop/api

https://bindceasdiwozx.shop/api

https://conformfucdioz.shop/api

Extracted

Family

lumma

C2

https://demandlinzei.shop/api

https://applyzxcksdia.shop/api

Targets

    • Target

      https://objects.githubusercontent.com/github-production-release-asset-2e65be/836419795/ee16c3b6-c75d-4b90-bf0e-af91d4d12bbf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240731%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240731T214729Z&X-Amz-Expires=300&X-Amz-Signature=1f4b117e624c5a2e64059802976f7210ab9e0f126a45801dfc884c14cf7b55ee&X-Amz-SignedHeaders=host&actor_id=117325187&key_id=0&repo_id=836419795&response-content-disposition=attachment%3B%20filename%3DSolaraInjector.rar&response-content-type=application%2Foctet-stream

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks