General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
lumma
C2
https://powerful-avoids.sbs
https://motion-treesz.sbs
https://disobey-curly.sbs
https://leg-sate-boat.sbs
https://story-tense-faz.sbs
https://blade-govern.sbs
https://occupy-blushi.sbs
https://frogs-severz.sbs
https://winterchill.shop/api
Extracted
Family
lumma
C2
https://winterchill.shop/api
https://blade-govern.sbs/api
https://story-tense-faz.sbs/api
https://disobey-curly.sbs/api
https://motion-treesz.sbs/api
https://powerful-avoids.sbs/api
Targets
-
-
Lumma family
-
A potential corporate email address has been identified in the URL: #Pa$$w0𝑅D-5917__Sat-Up@!
-
Executes dropped EXE
-
Loads dropped DLL
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext