General

  • Target

    fix.zip

  • Size

    366KB

  • Sample

    240826-vhsrtawepj

  • MD5

    cff8585ad323864f4f7d238a1d8c44bb

  • SHA1

    0fab9e24d34091d7cbbe07ccddb7e9536ab3a221

  • SHA256

    ddcc8c2d5496b09efa3a27a5bd1c9386b5595cb009c980a2703fc8c9f355b3b1

  • SHA512

    627dc5ca40475ec43faaba0d3c0f00ee3fd60bb27ced69e87137eb363ba5dd949d0cf77e511ef1f5ca6eb79db1dced1e8dec9663388e00135bbba6803f67b38d

  • SSDEEP

    6144:S7hxy0X5JxYye8AvkhoQokI0fOh7GNgrzKqo8FCv6xI:S7hU0X5Jy5DkhNtI60sCfo8FCCxI

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://froytnewqowv.shop/api

Targets

    • Target

      fix/msvcp140.dll

    • Size

      489KB

    • MD5

      08a0c0aa6e75a52d9ed0bd0754607c7d

    • SHA1

      881dad4658c27ae1d17f725eb3f36edb38d610c4

    • SHA256

      3c3c42cead64ab2c70a40cc1ac1bdec4c69c7c5457923df9bd0b05869f00db40

    • SHA512

      95d39baf9ad9622038456c6a34cef774bd9936c1f77d8270eb714d76d892c7e975a17fbbd710631b1f5400a6ca50fb07267b1179d351037855ad57b7db7687ec

    • SSDEEP

      6144:g2KfW1CyNMo17YwK0vVvzwmceNwpqObmenGHP/qkVzpEhZ2gfo8Bh112ERi9eV9x:g+VNRRYKsGHnqOpEhkUBLSs9x

    Score
    1/10
    • Target

      fix/x86_64-w64-ranlib.exe

    • Size

      240KB

    • MD5

      f22f1c4c170a1725d30ee476e6d8ab49

    • SHA1

      4dffb9f7e03b4fa10d7320251a09dae205757a78

    • SHA256

      546c34c2782216278a8273d3c9d3a954a980c7c2c7be220914aefe446fe94fd8

    • SHA512

      6313cfafc8d8c2b459039803dc8e53b20d1febf7d395cec3aca8737fe605fe53961c98e5a0140752125032ea329ee84991556de7d6c06f2397d116892482c1a3

    • SSDEEP

      3072:1DjBbSIIgnhE2ilnp1qyJEozan2/5NRnJsDqjUnM6tMhfa37/:1p2Tp0Mjy2Rfn1jEZz

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks