Overview

overview

10

Static

static

10

Extreme Injector.exe

windows7-x64

10

Extreme Injector.exe

windows10-2004-x64

10

Qt5Gui.dll

windows7-x64

3

Qt5Gui.dll

windows10-2004-x64

3

Qt5Network.dll

windows7-x64

3

Qt5Network.dll

windows10-2004-x64

3

Qt5Svg.dll

windows7-x64

3

Qt5Svg.dll

windows10-2004-x64

3

Qt5Widgets.dll

windows7-x64

3

Qt5Widgets.dll

windows10-2004-x64

3

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

msvcp140.dll

windows7-x64

1

msvcp140.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a.zip

  • Size

    5.3MB

  • Sample

    241128-ttfe7asqay

  • MD5

    8daabb56eac9a50bc60c24d47cd4ca73

  • SHA1

    c77921d8eb12edecc57846f66136ad23bccb0c60

  • SHA256

    b854463784f0a37615c216a36382f052c34c1fd60f8cab7ea21b6e4b74632101

  • SHA512

    f1eb0917c24e587b263523ddaec3b87235cb4de8907105d25f84cda29a042a35cc6a7f61c648a979f6e778698cb05ea3f9ec0e3b926a2b9af19ab2a229e374be

  • SSDEEP

    98304:dDV3njSDe83r2FK+dgpl+0NLuRZsm4NLuRZ9nJRzfc7IBqq7GOxX/DcYJk1NWaL4:X3njSDePFYDNqRZslNqRZ9vUUt5Jw/N4

Score
10/10
lummarhadamanthysdiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://property-imper.sbs

Targets

    • Target

      Extreme Injector.exe

    • Size

      120.4MB

    • MD5

      bb4a2e06a95bc52e52a7b73ac4dae017

    • SHA1

      6782e78fad29d8bb36a499f849e5f3752d3fd9c1

    • SHA256

      608008c03f7bc4f36570c0dd1c844dbd8cae45b290498fc696cf03be28c45065

    • SHA512

      5bbf706aeff7c16e593995712b0bda9d3db08e60ad1555d60cc15563c052c83284cdb4429504096a3575b27dd108d986115d7b043f7cff61c97d15869d20ab99

    • SSDEEP

      12288:LV4fznmsSlFU2yZEHL5gjC91pMb0xFhRTlr7v:LuyflFjyZEFQC912bmhRxr7v

    Score
    10/10
    lummadiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      Qt5Gui.dll

    • Size

      4.8MB

    • MD5

      d9b78f4b2f8f393c8854c7cc95eae5d8

    • SHA1

      8d648e7bda5b6bf7b02041189b9823fe8d4689e5

    • SHA256

      55faebb8f5e28cde50f561bbd2638db7edcfd26e7ee7b975e0049b113145ae38

    • SHA512

      6e76b524a56cc9bb5ae4beeedd41a48c35cf03c730752da3cae49862cb7bc3c17283099c39787f5933c1771eca7c2e651d92b961de7f43813f026eb295c90c81

    • SSDEEP

      49152:PcLeg66Ry8jdAYbppzo7Tzj1/JrRbkwW6Ydzzr3YCWizxCqDRkU9i4g1/JAyn:kLrBpr1o7bRyfdzzxz0NTA4

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Qt5Network.dll

    • Size

      840KB

    • MD5

      0fdda3a8c8be28993b156b24b300ccdf

    • SHA1

      57fe6cfd0b28708d23ae560675d4c462127722c8

    • SHA256

      335cec3a5f9082f083190660932b6641f682f4c5818ffbd6ffa98c9d0c24e0f1

    • SHA512

      4ba8b28ac903d087344185b77144bfcbcd5bda11efb2a8d45b942363b8a13c7c4fb56820644166c7556fb44b68a8786ebb10b8cc4b3557247aa85214289e4453

    • SSDEEP

      12288:/fGeWXoifZwygBFp9RsVqSA3jk1x5X+JPnk4PpazkoLhVY9hqivwlsBNzARfG2:/fGeWXoiBwHbHEgqM9BNzARfG2

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      Qt5Svg.dll

    • Size

      253KB

    • MD5

      06cc5d18a496520e05bcfee1e3169535

    • SHA1

      98ba5d0ed52499a845038c3b4bcba356b9339f11

    • SHA256

      ea31035fa96ba656d64b58d4f1a9dd210df7154afad3d4f96ee36b41584e4360

    • SHA512

      154a2fdbaa045df6289476420cc4045905a866cd54d756dcc09e0ea79f2cec7f33c748534f47c827841e35c35f71d462cadb801a6b99bf72c162c075d786fdbe

    • SSDEEP

      6144:kKD4dwpLEE61jMW52NP5xwuMnyOWYGcy8Dv4Cnke+9oCsGhvdw61IwxP4zd:kKD42pLEE6mw2NPnBMIBrU

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      Qt5Widgets.dll

    • Size

      4.3MB

    • MD5

      f697ffc85fb86d72654c4f5ba4e1bdc2

    • SHA1

      670657f598d408ab232dec75be6fc7983bc5ce4b

    • SHA256

      400fa69aa8803f6c3a6f9a5fc956475d0396095c4b6d4665b7aa29bbcb8e3640

    • SHA512

      47513892c22a193c51ecf09c8f3e4c4271a92be33b7b7d535290ea75a1498c5531881a26a85dbf758361e6892abf12a796f1c5c284a34f1d173d61d2012325b7

    • SSDEEP

      49152:Zhk8cs4FhK1FKBxR8Lcdm0OTqZ7uA/GrXHIaTU+cDZ0V37SUJ:7k8ymoBxKAdmL8yONaQi32UJ

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      Setup.exe

    • Size

      455KB

    • MD5

      9c36c6db9d21eb8e2e760dbcf3243c5f

    • SHA1

      89fff51cad1a0a022f707a4aabacf17a5718d308

    • SHA256

      505a6196ef55cdf6ea05981ff1a1e92de468e7dde04b38a4f6e1747cb84f3d89

    • SHA512

      f09f18d9fd264e004a6132a200992f2b9dfa24a1d628dd983d7ecd1ee3f3ab987957ba202db7f7ac42a40053c41961810ad37255daa1e3b3ebcac0e3ce5aad44

    • SSDEEP

      12288:LV4fznmsSlFU2yZEHL5gjC91pMb0xFhRTlr7v:LuyflFjyZEFQC912bmhRxr7v

    Score
    10/10
    lummadiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Suspicious use of SetThreadContext

    behavioral11behavioral12

    • Target

      msvcp140.dll

    • Size

      731KB

    • MD5

      45ad5195977a46b165bb96887ac206de

    • SHA1

      ade19c68fc90514a987760f3a0fe881bc2dc3bc4

    • SHA256

      60bffec055dcee0eed7c3d2820fb501f81e022a2911f7b01f5ad71bd130f2c12

    • SHA512

      643bb1a63211dcd8ec62f15740934039b7dead7e823688f50598657fa870f74c3e25c245b50108dc1fda0f0887105f398f8d62a56f6aa3f652368f48abc6e6f6

    • SSDEEP

      12288:OCF7Zcy+NjkHtlzigWBqf/qq3R5W8ZB4zmRzbaTsViRUF9TZ:F7iy+1k99f93PW8ZBS+zbm7sr

    Score
    1/10
    behavioral13behavioral14

MITRE ATT&CK Enterprise v15

Tasks