General

  • Target

    special beauty 49 (miniskirt-1406.zip

  • Size

    19.4MB

  • Sample

    241119-zx3yjssmcy

  • MD5

    e5accd7ebf4e00245fc6afa3f49ff32f

  • SHA1

    0ca38ce84c880fd964fe74fa7c900c85418695bd

  • SHA256

    9fad4dcaa59a8e3a9c388f900020bb81bff5192f551452d6dd6dc6ef7daba47d

  • SHA512

    b4a94472c9c89c3795b3fb317d3d96212c19204f74a382dc326a6e7d657a24d235950cd8f6f7d48aa9bc68d18e2585869748415f12dd18a789ed5c8ed60e9e2e

  • SSDEEP

    393216:/geLWwhr8/hgEjvz96H7LRQ0AaH6Je4GJ7X7VJDcRTUxdUUfM2:5Xa5gGL96bFQbJdArpUT1Uf9

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://ch33sep3ts.cyou/api

Targets

    • Target

      special beauty 49 (miniskirt, skirt, dress), carrefour (jupe jeans..collant r @imgsrc.ru.exe

    • Size

      860.2MB

    • MD5

      a37390fa3bc3648ceeba771bf296b5c8

    • SHA1

      6404b44b96db5a2426e84d737cd1e1a7ef49a91a

    • SHA256

      91c5dbe4968ab28c2480251a70b9a67abe8a8cf915fdb567f315c1a4bf916343

    • SHA512

      5bc925ae5261782da67a2e385a65af504a02de76d5094e4c50c697cd0396b5cf0614eec81f0820923513d07829b100c872bbdcdeeac809aa78b14c2d33fd2355

    • SSDEEP

      1572864:nAFP6FHJVdhRX6S9d6mEuQRZPy+SHQpKOPYYlf:nzZ8pf

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks