General

  • Target

    3ca0e4b388f3a46f2887f3040f47bf54bc12c416c32fbb9468132d364e54dc3e

  • Size

    6.9MB

  • Sample

    241227-ex4jvs1rej

  • MD5

    2dd3528391867366b3d8488aef5c4def

  • SHA1

    f8656d38f9d39e278c9300494a1b49360d5ce676

  • SHA256

    3ca0e4b388f3a46f2887f3040f47bf54bc12c416c32fbb9468132d364e54dc3e

  • SHA512

    c7fca0ca1d21dcfe4dacb25094eb49f4bfe05151614db992a5b3ea56efcd261f559b33fee58a394c1bd747ad8b017c34b8efbea29b797cb7c6d06bd3c96cd02c

  • SSDEEP

    196608:pawQlXLE1tjsJPZKNyh6qYebQrx6CIlVZ:paw/jLyW

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://hummskitnj.buzz/api

https://cashfuzysao.buzz/api

https://appliacnesot.buzz/api

https://screwamusresz.buzz/api

https://inherineau.buzz/api

https://scentniej.buzz/api

https://rebuildeso.buzz/api

https://prisonyfork.buzz/api

https://mindhandru.buzz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://mindhandru.buzz/api

https://prisonyfork.buzz/api

https://rebuildeso.buzz/api

https://scentniej.buzz/api

https://inherineau.buzz/api

https://screwamusresz.buzz/api

https://appliacnesot.buzz/api

https://cashfuzysao.buzz/api

https://hummskitnj.buzz/api

Targets

    • Target

      3ca0e4b388f3a46f2887f3040f47bf54bc12c416c32fbb9468132d364e54dc3e

    • Size

      6.9MB

    • MD5

      2dd3528391867366b3d8488aef5c4def

    • SHA1

      f8656d38f9d39e278c9300494a1b49360d5ce676

    • SHA256

      3ca0e4b388f3a46f2887f3040f47bf54bc12c416c32fbb9468132d364e54dc3e

    • SHA512

      c7fca0ca1d21dcfe4dacb25094eb49f4bfe05151614db992a5b3ea56efcd261f559b33fee58a394c1bd747ad8b017c34b8efbea29b797cb7c6d06bd3c96cd02c

    • SSDEEP

      196608:pawQlXLE1tjsJPZKNyh6qYebQrx6CIlVZ:paw/jLyW

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Modifies Windows Defender Real-time Protection settings

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks