General

  • Target

    b99.exe

  • Size

    270KB

  • Sample

    240925-pygrlayhlg

  • MD5

    d18738ee43bda16b6a6d309f2baeef4d

  • SHA1

    0b4f2aa3a84a168c9887d943f0b2c00058fe4110

  • SHA256

    11ba8ee81f38130b690c3c8b279fa4da0b01c87f57b940d7af5dab58b18fc9a7

  • SHA512

    17c8c50656f0b9ae46fdfcb16f5e2504a0b84bf45d2dc3a95119f01dbd6b4c4d2e36cb514a3fa607fb4c2d680b83249b5b0d972445064167b309f54b9ac68a5d

  • SSDEEP

    6144:NogwExxWrPSfzp5jCF6/okvkWaWTA8OPDgr0Op:1zp5jCs7pA8GQRp

Malware Config

Extracted

Family

lumma

C2

https://performenj.shop/api

Targets

    • Target

      b99.exe

    • Size

      270KB

    • MD5

      d18738ee43bda16b6a6d309f2baeef4d

    • SHA1

      0b4f2aa3a84a168c9887d943f0b2c00058fe4110

    • SHA256

      11ba8ee81f38130b690c3c8b279fa4da0b01c87f57b940d7af5dab58b18fc9a7

    • SHA512

      17c8c50656f0b9ae46fdfcb16f5e2504a0b84bf45d2dc3a95119f01dbd6b4c4d2e36cb514a3fa607fb4c2d680b83249b5b0d972445064167b309f54b9ac68a5d

    • SSDEEP

      6144:NogwExxWrPSfzp5jCF6/okvkWaWTA8OPDgr0Op:1zp5jCs7pA8GQRp

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks