General
-
Target
AquaPac v1.2.zip
-
Size
65.7MB
-
Sample
241229-2m3wxayrbl
-
MD5
e0c8235dc9e4b4f42ab5498aae088016
-
SHA1
96412922bd6bbd0297c426f5ff0b7992372e7e84
-
SHA256
62af490e0c16ad25316e36dfc6d7afc82d6496e33d7b4ff3839685096a0e78db
-
SHA512
b10288af31f8ad694838ad4dc39cb1c392d606a877660ec1091a987967148f6e55da3cb6a1bd0495b4e59d8aff30ba5d6f9b9410897a640072ad66794d734d0d
-
SSDEEP
1572864:sFq4e1MhUyoAoya1r90m9ykgA27QI4SAqHb9I8z9I0E4Lz53xjD:OeNZAo512mIkgAsQ4Hb9OgN3xjD
Static task
static1
Behavioral task
behavioral1
Sample
AquaPac v1.2/AquaPac.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
AquaPac v1.2/AquaPac.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
AquaPac v1.2/AquaPac.exe
Resource
win10ltsc2021-20241211-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
AquaPac v1.2/AquaPac.exe
-
Size
1.1MB
-
MD5
609acb4f45e7e7692dfedaee6c2854ad
-
SHA1
cd297298395ceb03f27c4f38e6e99c0deb6df88c
-
SHA256
e56496d1737c356ed7feacebe0daaf34781975fcae1fbd368cb5a7b2c2a1eae3
-
SHA512
67d3dc5399453a3a90c7af014542c60b93b41bbe00fcbcf4b18434e4011c400f7da1868d8865f629c7e2df7b2b9b11a3d52a004e7b139635ae1bd20becb648a4
-
SSDEEP
24576:+DJMEy2UJyOqKbUbnGfiBc8EFuoThlhZCq4ktw7:+Ny9qKbWnGC+FzThlhEqZtw
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-