General

  • Target

    678f3ff74a341bc6d6bff5f334508e4ea8305aba0e33c134fd5b0af3cd957d87.exe

  • Size

    1.8MB

  • Sample

    241119-fbnryszpgs

  • MD5

    9c292208017062c4d09720f198405a75

  • SHA1

    58fe6e3ff91f890537887e47cf68d8276d9f30ec

  • SHA256

    678f3ff74a341bc6d6bff5f334508e4ea8305aba0e33c134fd5b0af3cd957d87

  • SHA512

    8deb6b92eba12cf9603a9e586489d57b2ef67a919ca0bd123f1f74d489c0bceb0e1e09ad7245dbf4d0f4ae47ae3c379b5380e95b88db4b46869ed39499e84f9d

  • SSDEEP

    49152:BcPkKYK/QWasWmylC6lFDOI9czmUVoxUF69v:BcOIQboyl9FDOIemWoxK69v

Malware Config

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Targets

    • Target

      678f3ff74a341bc6d6bff5f334508e4ea8305aba0e33c134fd5b0af3cd957d87.exe

    • Size

      1.8MB

    • MD5

      9c292208017062c4d09720f198405a75

    • SHA1

      58fe6e3ff91f890537887e47cf68d8276d9f30ec

    • SHA256

      678f3ff74a341bc6d6bff5f334508e4ea8305aba0e33c134fd5b0af3cd957d87

    • SHA512

      8deb6b92eba12cf9603a9e586489d57b2ef67a919ca0bd123f1f74d489c0bceb0e1e09ad7245dbf4d0f4ae47ae3c379b5380e95b88db4b46869ed39499e84f9d

    • SSDEEP

      49152:BcPkKYK/QWasWmylC6lFDOI9czmUVoxUF69v:BcOIQboyl9FDOIemWoxK69v

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks