lumma | 7c270da2506ba3354531e0934096315422ee719ad9ea16cb1ee86a7004a9ce27

General

Target
XWorm-5.6-main.zip
Size 25.1MB
Sample241017-ae5a8avalj
SHA256 7c270da2506ba3354531e0934096315422ee719ad9ea16cb1ee86a7004a9ce27
MD5 95c1c4a3673071e05814af8b2a138be4
SHA1 4c08b79195e0ff13b63cfb0e815a09dc426ac340
SHA512 339a47ecfc6d403beb55d51128164a520c4bea63733be3cfd47aec47953fbf2792aa4e150f4122994a7620122b0e0fc20c1eeb2f9697cf5578df08426820fecd
SSDEEP 786432:Ty5jMDNnx2+4NYobtH8VVtKqi9+i514XZ/pjYlp0:MMDNnxV4iobxibiIi5MpjYv0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:8888

Mutex

maoR2mXoJbzjTaPs

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

lumma

C2

https://pillowbrocccolipe.shop/api
https://communicationgenerwo.shop/api
https://diskretainvigorousiw.shop/api
https://affordcharmcropwo.shop/api
https://dismissalcylinderhostw.shop/api
https://enthusiasimtitleow.shop/api
https://worryfillvolcawoi.shop/api
https://cleartotalfisherwo.shop/api

Targets

- Target
  XWorm-5.6-main/Fixer.bat
- Size 122B
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- MD5 SHA1 SHA512
Score

5^/10
- Drops file in System32 directory
behavioral1
- Target
  XWorm-5.6-main/Plugins/Options.dll
- Size 30KB
- SHA256 5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78
- MD5 97193fc4c016c228ae0535772a01051d
- SHA1 f2f6d56d468329b1e9a91a3503376e4a6a4d5541
- SHA512 9f6d7da779e8c9d7307f716d4a4453982bb7f090c35947850f13ec3c9472f058fc11e1120a9641326970b9846d3c691e0c2afd430c12e5e8f30abadb5dcf5ed2
- SSDEEP 768:ULxkuz7dDWH839iybgkf/sGRNW9S9dhjcI:ULNHqUPbgQsGRNW9S9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  XWorm-5.6-main/RES/XWorm.Resources.resources
- Size 1.6MB
- SHA256 557058bd29a5eb55ef073ea9c4dec0baea1fd3f3f4bf2cdd5ee3dfd33735e93a
- MD5 34986e38b463873af40f694874c1f6d3
- SHA1 8fa89cdb7a394cf8093d548ca9db4652c703ee72
- SHA512 c1b0278e8c21e5c28204f692a5cf5ed16c8ada0c6022d7d38e70905255f3aeb5d2c0fd4549f0ed19ead52aa0ced891a8f9372123bf5e1710be004958750874e4
- SSDEEP 49152:OsP2WTJcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHXH:zuWTGLP9Pk6gAK6n4ldyNh3
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3
- Target
  XWorm-5.6-main/Xworm V5.6.exe
- Size 14.9MB
- SHA256 90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
- MD5 56ccb739926a725e78a7acf9af52c4bb
- SHA1 5b01b90137871c3c8f0d04f510c4d56b23932cbc
- SHA512 2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
- SSDEEP 196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stormkitty xworm discovery rat spyware stealer trojan
- Detect Xworm Payload
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
behavioral4
- Target
  XWorm-5.6-main/XwormLoader.exe
- Size 490KB
- SHA256 f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
- MD5 9c9245810bad661af3d6efec543d34fd
- SHA1 93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
- SHA512 90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
- SSDEEP 6144:3PkcFUUUQHs5TlOhDuy4VjmSO6/tU4j06xeJyCjvhsXZ4m05d0qCsfBLuWWCV/rr:3McWUUysz/NhKjJPhM4/5bV/rvgE3
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lumma discovery stealer
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
behavioral5