General
-
Target
f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e.exe
-
Size
1.8MB
-
Sample
241117-rgl14a1gpb
-
MD5
94aac30065fe1780afe1a0cb1bc107da
-
SHA1
8cc8b365f75cb569d6943eb99a6f287d794ebe43
-
SHA256
f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e
-
SHA512
1fd830e985d07fa7011cc7ad9bf60a6e1a5cb59f5d4b3ac8fced9d9cc9ce08b03d40d1a02fc03649364902bdc3b40363d96855c30f754bb54e610d01ad424a21
-
SSDEEP
49152:QoDhMbY3Gkn4sWbcgeN0J045/ynxqDozPm0WzmKzyrd2n:bDr4Bb/5u4FyjmzmdY
Static task
static1
Behavioral task
behavioral1
Sample
f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://processhol.sbs/api
https://p10tgrace.sbs/api
https://peepburry828.sbs/api
https://3xp3cts1aim.sbs/api
https://p3ar11fter.sbs/api
Targets
-
-
Target
f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e.exe
-
Size
1.8MB
-
MD5
94aac30065fe1780afe1a0cb1bc107da
-
SHA1
8cc8b365f75cb569d6943eb99a6f287d794ebe43
-
SHA256
f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e
-
SHA512
1fd830e985d07fa7011cc7ad9bf60a6e1a5cb59f5d4b3ac8fced9d9cc9ce08b03d40d1a02fc03649364902bdc3b40363d96855c30f754bb54e610d01ad424a21
-
SSDEEP
49152:QoDhMbY3Gkn4sWbcgeN0J045/ynxqDozPm0WzmKzyrd2n:bDr4Bb/5u4FyjmzmdY
-
Lumma family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2