Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file.exe

  • Size

    1.8MB

  • Sample

    241013-rcnzwszeqb

  • MD5

    44f1cc6adb5b7059defb4a1a36f99f26

  • SHA1

    21d3efbd6b35443d9690e21cbcc2b9e700559507

  • SHA256

    687ec470552c254e0ef470c0f1dcfe445accbc42e39a9eada30d8a27884aecf5

  • SHA512

    39466109bd2896911ff2d52874706ec27e76a029e610a8a25ebad98731a9299c166e465785473616449616521a9906d469f3474e974e5dc7348f2750916a5258

  • SSDEEP

    49152:nPtNhwSji00m7KF9v9+uP8ycit4lPBJFGIDJFNKuVMOK7d:nPtQGHKjv9hOJlhWd

Malware Config

Extracted

Family

lumma

C2

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Targets

    • Target

      file.exe

    • Size

      1.8MB

    • MD5

      44f1cc6adb5b7059defb4a1a36f99f26

    • SHA1

      21d3efbd6b35443d9690e21cbcc2b9e700559507

    • SHA256

      687ec470552c254e0ef470c0f1dcfe445accbc42e39a9eada30d8a27884aecf5

    • SHA512

      39466109bd2896911ff2d52874706ec27e76a029e610a8a25ebad98731a9299c166e465785473616449616521a9906d469f3474e974e5dc7348f2750916a5258

    • SSDEEP

      49152:nPtNhwSji00m7KF9v9+uP8ycit4lPBJFGIDJFNKuVMOK7d:nPtQGHKjv9hOJlhWd

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks