General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
lumma
C2
https://winterchill.shop/api
https://blade-govern.sbs/api
https://story-tense-faz.sbs/api
https://disobey-curly.sbs/api
https://motion-treesz.sbs/api
https://powerful-avoids.sbs/api
Targets
-
-
Lumma family
-
A potential corporate email address has been identified in the URL: #Pa$$w0𝑅D-5917__Sat-Up@!
-
Executes dropped EXE
-
Loads dropped DLL
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext