General

  • Target

    Loader.zip

  • Size

    497KB

  • Sample

    241021-sfwpksxhlb

  • MD5

    ceae8d0b585a04fb7322172c6bc2eb6f

  • SHA1

    0036d3b6315587cb75aa1fe00ec37c9bf57c34ac

  • SHA256

    b67f05713fc0d11afb62b4ee57286c46efaca666ebeb44f3a1e0987df90399d3

  • SHA512

    92b371a8bd5bbdb20bca7cbfd4f96c2614e9a022b7e759bb9a95a0e424b994f5e916fc3248e6e6abdcb4341a05abc62bb2a7012682e2cb5b5a26f0ecda1eb154

  • SSDEEP

    12288:8r5y/MxYH6FxaoJ5W6a3wPHjYuYOAhXsDNHmY8KJg0M3ERlAJFfN:8r5ykiIRJdumkuYrXslmYPv2FfN

Malware Config

Extracted

Family

lumma

C2

https://conceptionnyi.sbs

https://platformcati.sbs

https://nervepianoyo.sbs

https://qualifielgalt.sbs

https://smashygally.sbs

https://fightyglobo.sbs

https://modellydivi.sbs

https://pioneeruyj.sbs

Targets

    • Target

      Loader/Loader.exe

    • Size

      1.5MB

    • MD5

      c7cbc6cce446b9db8d3880d2348a8cb7

    • SHA1

      0eabfe7773d0e74af54cfc1aff6fd5cd209ef229

    • SHA256

      74039bd80009452e741dc66a2082a59afefd3ed828ee8fd8bf99af94cd8562f9

    • SHA512

      3df84f577036669731577ad58a2f4ef227fe9ef640703d8cc22a3d840e587fcbfc66155ce57f117b7739960fc4dfa762127dbcd6dccc655a8e2cff826f0f9a97

    • SSDEEP

      24576:xnTMSJvZFsdbrgBVxZI4nRHveh2LEreOt2bJoa/t2ATDzPodXMg8zcC5lwgtIBNa:BCcJ9wKJh

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

    • Target

      Loader/dmxmlhelputils.dll

    • Size

      259B

    • MD5

      9abd95d760a752257bcb7f5ee3c14008

    • SHA1

      29c4a0b474ef189b2f6a267d560b103ab5f4b323

    • SHA256

      d9050e97477cfe7be44992a505c2cdad8f0f43a3c0bf0e1e1a3d1f175d92ac51

    • SHA512

      f39a345e695d42d81a35b71923da8dd1907a0c48da24f580a102600fb72bcf259ee817414e736d67b0f1196dae0610a00926b1aa94640171e6f5cf09b6830da7

    Score
    1/10
    • Target

      Loader/likodi/NotificationController.dll.mui

    • Size

      4KB

    • MD5

      5a940db75a80c7571cc221cf3870ef78

    • SHA1

      203ac94c768a8916ce70f6db7ada481185c06eaf

    • SHA256

      d3e15411a49c52b69d00ea4c32a3eba6eadb26da7b7f294e90c75aa7d33f210f

    • SHA512

      ec639abf80a633f3fa1a848d2236ca8cf28d45a5a0af85df6c3273f05fcb6db2fe6afbc057761c07234ca3f9b619866697dd357d155ab5df8e1687267ecc7099

    Score
    1/10
    • Target

      Loader/samlib.dll

    • Size

      9KB

    • MD5

      f3078d7cbe7d330f06c51dc177f58e6f

    • SHA1

      bb191e939d938b6fd9145473b4fb16cd48e33595

    • SHA256

      83b293af5ae8fa2f226dc86c4b9aeb5f6af41880eb72c55c895c2ab445b0bbd9

    • SHA512

      1749bbc37baa46aa95a883029ac52a366fbbe26963ac38e34dc5f6eca150a6a6158f8657543d4ecef59dae3570180bf472c981b1473c98be9c570b42aab0e897

    • SSDEEP

      192:xxoFkSrGiZ3P621D3xjzAS9CNnGhk8YGCPQp+7FTQgl7OQHQF2T:xxofVZ3T9jkS9ClwkvGsDppl3wET

    Score
    1/10
    • Target

      Loader/wdi.dll

    • Size

      86KB

    • MD5

      7d326b235ab064ff70376f1d015cc084

    • SHA1

      3b394e93ef206d30fafbf3202a5a63a4b6667580

    • SHA256

      404dda0bdf9a6c1c61653cf7e965f504b3a3a3b662f88c906aaa19a9c3df160c

    • SHA512

      f33face04507edd462b40dfd0771da3f241374c99fc956def9678a05c15bf5f8c945579006ab250646120a7f983fe4a57b55c93bdf921142f6464bc74fee2347

    • SSDEEP

      1536:2xg+XurUE+dlamMsyhirFoNZ5MtDPQEInpF6qbTyuVKiRoTnd5Zatd2nZXBjVym4:2x5XXdMTsyhirFoNZ5MtDIBpFtvLASoy

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks