General
-
Target
PASS-1234.exe
-
Size
1.6MB
-
Sample
240801-ztgwxa1ajh
-
MD5
84a9c6ce9bba17f0f6687555c73bebb8
-
SHA1
59240c3b11b160067a02400b0d484ff0fe33aa4d
-
SHA256
bc634b24b95a01a85984c55d7f37a2e1be6242bbc750a8f5c6cb4b7979f3cd2b
-
SHA512
1add11137bb3da3a1953fad137e02e29f04b43b5a8ac5adef595291e368565a4903e9a3d9450ddd08207db9df200bfcfac9fdc6127345c009c06f29df9c4e5ab
-
SSDEEP
12288:kDACg5dh75plVRAtugzZ766KcMuFad9kq42CWc50UqICLadUNH6i9MbglKt0096o:kDg7EM6/qsxvgEx9q/
Static task
static1
Behavioral task
behavioral1
Sample
PASS-1234.exe
Resource
win7-20240704-en
Malware Config
Extracted
lumma
https://deadpannsjzvn.shop/api
https://empiredzmwnx.shop/api
https://boattyownerwrv.shop/api
https://rainbowmynsjn.shop/api
https://definitonizmnx.shop/api
https://creepydxzoxmj.shop/api
https://budgetttysnzm.shop/api
https://chippyfroggsyhz.shop/api
https://assumedtribsosp.shop/api
Extracted
lumma
https://deadpannsjzvn.shop/api
https://empiredzmwnx.shop/api
https://boattyownerwrv.shop/api
https://rainbowmynsjn.shop/api
https://definitonizmnx.shop/api
https://creepydxzoxmj.shop/api
https://budgetttysnzm.shop/api
https://chippyfroggsyhz.shop/api
https://assumedtribsosp.shop/api
https://tenntysjuxmz.shop/api
Targets
-
-
Target
PASS-1234.exe
-
Size
1.6MB
-
MD5
84a9c6ce9bba17f0f6687555c73bebb8
-
SHA1
59240c3b11b160067a02400b0d484ff0fe33aa4d
-
SHA256
bc634b24b95a01a85984c55d7f37a2e1be6242bbc750a8f5c6cb4b7979f3cd2b
-
SHA512
1add11137bb3da3a1953fad137e02e29f04b43b5a8ac5adef595291e368565a4903e9a3d9450ddd08207db9df200bfcfac9fdc6127345c009c06f29df9c4e5ab
-
SSDEEP
12288:kDACg5dh75plVRAtugzZ766KcMuFad9kq42CWc50UqICLadUNH6i9MbglKt0096o:kDg7EM6/qsxvgEx9q/
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-