General
-
Target
file.exe
-
Size
1.8MB
-
Sample
241117-k2p5xs1jdm
-
MD5
c3384cbcfd7f594f40fe489f5f67a36f
-
SHA1
37f8f298e7ef281a821e38cc08abb72d679c9b2d
-
SHA256
dbaa65c338340985131358f76f903a03045da28aaaa6297f37bf8f5123defcf2
-
SHA512
e68fc70a6bd04045e13712f95bee04070eeb2fc99cd02703eb15a583dfa49e0ee1e70a08b294072e0a6676cdaeb9e4dbd10fc06e6f3d8d7cf6ded951afc215ea
-
SSDEEP
49152:AHJ/HR69tKztupUL4o3VUJiAr8kZKfQBoypZmu8w2A:iJ/Hy3UkolfArDQfyoypX
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://processhol.sbs/api
https://p10tgrace.sbs/api
https://peepburry828.sbs/api
https://3xp3cts1aim.sbs/api
https://p3ar11fter.sbs/api
Targets
-
-
Target
file.exe
-
Size
1.8MB
-
MD5
c3384cbcfd7f594f40fe489f5f67a36f
-
SHA1
37f8f298e7ef281a821e38cc08abb72d679c9b2d
-
SHA256
dbaa65c338340985131358f76f903a03045da28aaaa6297f37bf8f5123defcf2
-
SHA512
e68fc70a6bd04045e13712f95bee04070eeb2fc99cd02703eb15a583dfa49e0ee1e70a08b294072e0a6676cdaeb9e4dbd10fc06e6f3d8d7cf6ded951afc215ea
-
SSDEEP
49152:AHJ/HR69tKztupUL4o3VUJiAr8kZKfQBoypZmu8w2A:iJ/Hy3UkolfArDQfyoypX
-
Lumma family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-