General
-
Target
ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393.exe
-
Size
1.8MB
-
Sample
241117-rj4zpa1hkb
-
MD5
f373903154200ae4d75d16954e1dc2c1
-
SHA1
9672a2e737961ff0e8ea3383c8fd3b41b673f706
-
SHA256
ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393
-
SHA512
d045fdb4bdbbf274b527235d53c50deff2a145a0b47722dbc746019f5103acd0e18e983ef552763790b123720214eecc2980788f3599bd9d2f9172c6471c41f9
-
SSDEEP
24576:+MILAOL37KIgzU5Ffb29AeR4JPaU2jtcRQcpghi35rb6i9mUt1cJ0GpXmLlHzbXi:+lLZQUpXv2O+i35rb/HDbNt
Static task
static1
Behavioral task
behavioral1
Sample
ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393.exe
Resource
win7-20240729-en
Malware Config
Extracted
lumma
https://processhol.sbs/api
https://p10tgrace.sbs/api
https://peepburry828.sbs/api
https://3xp3cts1aim.sbs/api
https://p3ar11fter.sbs/api
Targets
-
-
Target
ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393.exe
-
Size
1.8MB
-
MD5
f373903154200ae4d75d16954e1dc2c1
-
SHA1
9672a2e737961ff0e8ea3383c8fd3b41b673f706
-
SHA256
ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393
-
SHA512
d045fdb4bdbbf274b527235d53c50deff2a145a0b47722dbc746019f5103acd0e18e983ef552763790b123720214eecc2980788f3599bd9d2f9172c6471c41f9
-
SSDEEP
24576:+MILAOL37KIgzU5Ffb29AeR4JPaU2jtcRQcpghi35rb6i9mUt1cJ0GpXmLlHzbXi:+lLZQUpXv2O+i35rb/HDbNt
-
Lumma family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2