General
-
Target
secrator.txt
-
Size
493B
-
Sample
241119-mrxs5avbkd
-
MD5
7cc08429b87f9aba8606e95114957b82
-
SHA1
2ba425be1fe0f12fa419bc93c22e7a2079b0c6b7
-
SHA256
856be8a4d18a57d625d371054956b9ff1b9824e05894530bcf843629dce33cac
-
SHA512
91bf2f2c4090505e0606802aa64c1220729f08f1f3087cd5d4d81923d4d838a8459686a33fa60c2291398560aa47b19f697a29d067bd4cfbc4ff018c909bc4c9
Static task
static1
Behavioral task
behavioral1
Sample
secrator.ps1
Resource
win7-20240903-en
Malware Config
Extracted
https://storageinstance.oss-ap-southeast-1.aliyuncs.com/cincinati.zip
Extracted
lumma
https://processhol.sbs/api
https://p10tgrace.sbs/api
https://peepburry828.sbs/api
https://3xp3cts1aim.sbs/api
https://p3ar11fter.sbs/api
Targets
-
-
Target
secrator.txt
-
Size
493B
-
MD5
7cc08429b87f9aba8606e95114957b82
-
SHA1
2ba425be1fe0f12fa419bc93c22e7a2079b0c6b7
-
SHA256
856be8a4d18a57d625d371054956b9ff1b9824e05894530bcf843629dce33cac
-
SHA512
91bf2f2c4090505e0606802aa64c1220729f08f1f3087cd5d4d81923d4d838a8459686a33fa60c2291398560aa47b19f697a29d067bd4cfbc4ff018c909bc4c9
-
Lumma family
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist
-