General
-
Target
30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55.exe
-
Size
1.8MB
-
Sample
241117-jxazrszjfl
-
MD5
bdc56948ae92968dd03685f176d82952
-
SHA1
68d97b5441573567ff1b2361d14f167d2f759232
-
SHA256
30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55
-
SHA512
3606ef9656ec7e65b3b5f9486ca364536368af3126c604a48621092a131f032ba2623ce9c84d3fcf733d2d10ad1f0c8dbe93cccc8d095f924cc735bccf1e55eb
-
SSDEEP
49152:n72Kiu5J6gOj+r2Ju32ZJ/nlrq7T9mra/:n7Piu5vOj+rYjJ/Cs
Static task
static1
Behavioral task
behavioral1
Sample
30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://processhol.sbs/api
https://p10tgrace.sbs/api
https://peepburry828.sbs/api
https://3xp3cts1aim.sbs/api
https://p3ar11fter.sbs/api
Targets
-
-
Target
30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55.exe
-
Size
1.8MB
-
MD5
bdc56948ae92968dd03685f176d82952
-
SHA1
68d97b5441573567ff1b2361d14f167d2f759232
-
SHA256
30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55
-
SHA512
3606ef9656ec7e65b3b5f9486ca364536368af3126c604a48621092a131f032ba2623ce9c84d3fcf733d2d10ad1f0c8dbe93cccc8d095f924cc735bccf1e55eb
-
SSDEEP
49152:n72Kiu5J6gOj+r2Ju32ZJ/nlrq7T9mra/:n7Piu5vOj+rYjJ/Cs
-
Lumma family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2