General
-
Target
special beauty 49 (miniskirt-1406.zip
-
Size
19.4MB
-
Sample
241119-zx3yjssmcy
-
MD5
e5accd7ebf4e00245fc6afa3f49ff32f
-
SHA1
0ca38ce84c880fd964fe74fa7c900c85418695bd
-
SHA256
9fad4dcaa59a8e3a9c388f900020bb81bff5192f551452d6dd6dc6ef7daba47d
-
SHA512
b4a94472c9c89c3795b3fb317d3d96212c19204f74a382dc326a6e7d657a24d235950cd8f6f7d48aa9bc68d18e2585869748415f12dd18a789ed5c8ed60e9e2e
-
SSDEEP
393216:/geLWwhr8/hgEjvz96H7LRQ0AaH6Je4GJ7X7VJDcRTUxdUUfM2:5Xa5gGL96bFQbJdArpUT1Uf9
Static task
static1
Malware Config
Extracted
lumma
https://ch33sep3ts.cyou/api
Targets
-
-
Target
special beauty 49 (miniskirt, skirt, dress), carrefour (jupe jeans..collant r @imgsrc.ru.exe
-
Size
860.2MB
-
MD5
a37390fa3bc3648ceeba771bf296b5c8
-
SHA1
6404b44b96db5a2426e84d737cd1e1a7ef49a91a
-
SHA256
91c5dbe4968ab28c2480251a70b9a67abe8a8cf915fdb567f315c1a4bf916343
-
SHA512
5bc925ae5261782da67a2e385a65af504a02de76d5094e4c50c697cd0396b5cf0614eec81f0820923513d07829b100c872bbdcdeeac809aa78b14c2d33fd2355
-
SSDEEP
1572864:nAFP6FHJVdhRX6S9d6mEuQRZPy+SHQpKOPYYlf:nzZ8pf
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist
-