General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.6833.15280.exe

  • Size

    271KB

  • Sample

    240818-pp1s4stcrh

  • MD5

    bc69654f4acbad8da36209874381c000

  • SHA1

    bc4247a37d742462a3e1a46d40c1111b9f7cb4e1

  • SHA256

    3560e8b8fec76d8dccfc945bddad8f6d77c6473ff144d722a559a9ace78e77d1

  • SHA512

    4cf9e7755789d467f5a8972508f74090ec39cbbf5e24ed03d1a87c6d71ac651c721597f03f1fd8a784e457980ec0daf065c7886283e5cd5fd1b546bdd6020d78

  • SSDEEP

    6144:mhMp4PEIX72kIEcKBkXyTC81A++HlMrmrzH+pogiKR:mhNSkIEcKj/+HlMrmrzHRgiKR

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://importancedopz.shop/api

https://unseaffarignsk.shop/api

https://shepherdlyopzc.shop/api

https://upknittsoappz.shop/api

https://liernessfornicsa.shop/api

https://outpointsozp.shop/api

https://callosallsaospz.shop/api

https://lariatedzugspd.shop/api

https://indexterityszcoxp.shop/api

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.6833.15280.exe

    • Size

      271KB

    • MD5

      bc69654f4acbad8da36209874381c000

    • SHA1

      bc4247a37d742462a3e1a46d40c1111b9f7cb4e1

    • SHA256

      3560e8b8fec76d8dccfc945bddad8f6d77c6473ff144d722a559a9ace78e77d1

    • SHA512

      4cf9e7755789d467f5a8972508f74090ec39cbbf5e24ed03d1a87c6d71ac651c721597f03f1fd8a784e457980ec0daf065c7886283e5cd5fd1b546bdd6020d78

    • SSDEEP

      6144:mhMp4PEIX72kIEcKBkXyTC81A++HlMrmrzH+pogiKR:mhNSkIEcKj/+HlMrmrzHRgiKR

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks