General
-
Target
gkzHdqfg.ps1
-
Size
51.3MB
-
Sample
241122-szrjzatlgt
-
MD5
d71c930452ae704ac29ec1e5e4586fe3
-
SHA1
8651de4941bb4660fb3b3ae9442a8f6fcda2d51f
-
SHA256
ee27463e66262cb5be6a087222573b30516fa70b911e359e469e7cc03427e38c
-
SHA512
e665f1de54c422f8947e59fa8ebf8136c3157c1686e5e153904d97f1d7a904e2d10f611359b2808d0ceb0e40862fdf0d33c1ad4f2f5960b2a60294378e485466
-
SSDEEP
49152:DXyMg7Tu4U0/N/sNe3nxbrLU9Y+HiKzc06HSr5nNALrfJ+Wa93QJkHVgTETwWfc/:s
Static task
static1
Behavioral task
behavioral1
Sample
gkzHdqfg.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
gkzHdqfg.ps1
Resource
win10v2004-20241007-en
Malware Config
Extracted
lumma
https://candidatersz.cyou/api
Targets
-
-
Target
gkzHdqfg.ps1
-
Size
51.3MB
-
MD5
d71c930452ae704ac29ec1e5e4586fe3
-
SHA1
8651de4941bb4660fb3b3ae9442a8f6fcda2d51f
-
SHA256
ee27463e66262cb5be6a087222573b30516fa70b911e359e469e7cc03427e38c
-
SHA512
e665f1de54c422f8947e59fa8ebf8136c3157c1686e5e153904d97f1d7a904e2d10f611359b2808d0ceb0e40862fdf0d33c1ad4f2f5960b2a60294378e485466
-
SSDEEP
49152:DXyMg7Tu4U0/N/sNe3nxbrLU9Y+HiKzc06HSr5nNALrfJ+Wa93QJkHVgTETwWfc/:s
Score10/10-
Lumma family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext
-