Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    69f34af8c5469523637481e6932c9bbd3323f42952417d37c889989e2e654204.exe

  • Size

    1.8MB

  • Sample

    241010-b4qd2aterg

  • MD5

    0b18cf132a2c06c69ffa63a2162c0066

  • SHA1

    29ce991d4b9e48d3229ddad44c21985a86c44720

  • SHA256

    69f34af8c5469523637481e6932c9bbd3323f42952417d37c889989e2e654204

  • SHA512

    83c4db72abefb5df7ce0d7b3973d430544201a653afff2ecabbc7471178dacc6c34a71af42cff77999051e56f280697afbefe2295c88384c83ee77ee1d6f1f7f

  • SSDEEP

    49152:jrWkttjar3NCC0v3ZWeZe+SY7eD7ds2YT1MdNpabKpF:nWkjlCI0eZe+772HdNbn

Malware Config

Extracted

Family

lumma

C2

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Targets

    • Target

      69f34af8c5469523637481e6932c9bbd3323f42952417d37c889989e2e654204.exe

    • Size

      1.8MB

    • MD5

      0b18cf132a2c06c69ffa63a2162c0066

    • SHA1

      29ce991d4b9e48d3229ddad44c21985a86c44720

    • SHA256

      69f34af8c5469523637481e6932c9bbd3323f42952417d37c889989e2e654204

    • SHA512

      83c4db72abefb5df7ce0d7b3973d430544201a653afff2ecabbc7471178dacc6c34a71af42cff77999051e56f280697afbefe2295c88384c83ee77ee1d6f1f7f

    • SSDEEP

      49152:jrWkttjar3NCC0v3ZWeZe+SY7eD7ds2YT1MdNpabKpF:nWkjlCI0eZe+772HdNbn

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks