Resubmissions

10/08/2024, 10:12

240810-l8ylbaygrb 10

10/08/2024, 09:23

240810-lcxn5stepr 10

General

  • Target

    Ulpack.exe

  • Size

    16.0MB

  • Sample

    240810-l8ylbaygrb

  • MD5

    7dd6004ce6eaec9139139e0c92068fc0

  • SHA1

    a0e6eb405fe808c39bbfc5d1d63bf2d7fe2eb0be

  • SHA256

    44faf1729608e3e8a653b9868d50d849c887e62ab273e9655822a9a7a5eea3a1

  • SHA512

    0e10214628988351d1943e3625c7aaae0eb992c271882451eb3a701d6f52d5d73a9e65995fb31d7016e6a2eec88a076289be90f5a3d8ecf7ac0780003ddcb946

  • SSDEEP

    98304:Cm7G7uJhCw6glxEfWM4jfI1fBBEj7lFjdiypGbsfTuhbf:phCw6gzSWMBfwjJad9f

Malware Config

Extracted

Family

lumma

C2

https://solutionpxmuzo.shop/api

https://celebratioopz.shop/api

https://writerospzm.shop/api

https://deallerospfosu.shop/api

https://bassizcellskz.shop/api

https://mennyudosirso.shop/api

https://languagedscie.shop/api

https://complaintsipzzx.shop/api

https://quialitsuzoxm.shop/api

https://tenntysjuxmz.shop/api

Targets

    • Target

      Ulpack.exe

    • Size

      16.0MB

    • MD5

      7dd6004ce6eaec9139139e0c92068fc0

    • SHA1

      a0e6eb405fe808c39bbfc5d1d63bf2d7fe2eb0be

    • SHA256

      44faf1729608e3e8a653b9868d50d849c887e62ab273e9655822a9a7a5eea3a1

    • SHA512

      0e10214628988351d1943e3625c7aaae0eb992c271882451eb3a701d6f52d5d73a9e65995fb31d7016e6a2eec88a076289be90f5a3d8ecf7ac0780003ddcb946

    • SSDEEP

      98304:Cm7G7uJhCw6glxEfWM4jfI1fBBEj7lFjdiypGbsfTuhbf:phCw6gzSWMBfwjJad9f

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks