Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    il333.zip

  • Size

    890KB

  • Sample

    240925-rynk9atgje

  • MD5

    7e232db7db19daa4f1d80ddb0883fb85

  • SHA1

    36779d45a6b9bbd78db63969e81da6f4d3e2b5ee

  • SHA256

    c041f44a3bb38b1984d1511a86bb95aedf5bcd95849aff0e04f89d148d7d4eda

  • SHA512

    6cf676495f36ebd9f8f7f0c36dbb89b2704a894d8fdd33b629f1b7c9014494439486a141c5d00cee9f05d54aa80c74e95dc6922b0e30d01d79c0add17ffa7c8f

  • SSDEEP

    24576:5sNx2T00Kp+Gw5P1hqkRGnuTk6ef/PFyCY8/hgz8T:mNx2T4QnP1hbYCk6efFY8az8T

Malware Config

Extracted

Family

lumma

C2

https://liedshorqwi.shop/api

Targets

    • Target

      updater_[1MB]_[unsign].exe

    • Size

      1.5MB

    • MD5

      2c0adfb41272c40cc6e1ed9bd94f1c27

    • SHA1

      b863d1481e9737b66a42495e923626d3df42ffa5

    • SHA256

      927ed16d5b82b3d2c8a922d668da179e0e64664ee96b733d763733287d96e77d

    • SHA512

      d63f677a11b2674c297cf794195e71c8417d2040adc715ec90fa004dd1307e894421ef94aa881d3f696ea33cc662889538bedf25a94993ce895ce78eff54b52d

    • SSDEEP

      49152:Ns83Z1dHB/fZa3mHxTDflSvj5sKmrBZwshcsQpOyJqS:mOTbDflZbQpd

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks