General

  • Target

    86171a3930cf521025c39ec4404acbf8.exe

  • Size

    2.9MB

  • Sample

    241109-xm276azera

  • MD5

    86171a3930cf521025c39ec4404acbf8

  • SHA1

    c92e3b71e33a9af2535d879c0cc91ec6246f510d

  • SHA256

    0a76324906fdcaa883bb193510c05773fa2c0cb9ac19e6dc01896e9e0b87df10

  • SHA512

    aa26bc5ebc7bca9a00fda536f49a73b96ae9a5b7458cb5e91231f3928ca91b64c928f42f93accdde4504fae24bece7cf804efd3d2e10441b2381652c08b795f8

  • SSDEEP

    49152:J7jsTz1WVKjxxkajWpzIgjBHZtqdDWhEKZabZa:BCkVKtxhjWpzv9HZMkEKYbZa

Malware Config

Extracted

Family

lumma

C2

https://navygenerayk.store/api

Targets

    • Target

      86171a3930cf521025c39ec4404acbf8.exe

    • Size

      2.9MB

    • MD5

      86171a3930cf521025c39ec4404acbf8

    • SHA1

      c92e3b71e33a9af2535d879c0cc91ec6246f510d

    • SHA256

      0a76324906fdcaa883bb193510c05773fa2c0cb9ac19e6dc01896e9e0b87df10

    • SHA512

      aa26bc5ebc7bca9a00fda536f49a73b96ae9a5b7458cb5e91231f3928ca91b64c928f42f93accdde4504fae24bece7cf804efd3d2e10441b2381652c08b795f8

    • SSDEEP

      49152:J7jsTz1WVKjxxkajWpzIgjBHZtqdDWhEKZabZa:BCkVKtxhjWpzv9HZMkEKYbZa

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks