General
-
Target
griefinsight.t.me.bin
-
Size
36.4MB
-
Sample
241229-ba8nhsxlaw
-
MD5
ccdff4b1fcc7f0bf1fee65fe759c2f63
-
SHA1
ab65ccb587e236a4efd13ed53da340cfc5390e5f
-
SHA256
bcd89261e8260d0498651bcf52a817cc6221c0c39e96c262d22c5006bff8894a
-
SHA512
2105b211bab0fb3778cbc8dcef757c937f65a5a1bb41233be902966ac4e093faf0b6d2f99299f669cd4c3709f9980efe60c20b19e51cddde500c4af0390a0d6d
-
SSDEEP
196608:XNQpKtZcrSXs7GljVyFlQlhTuoRIUckZP9aiUcm/6vjIKjLDpuxDJEvKoJIX1Udz:sOZgq5FMi5lLDK5tkrDEBA9Zj2PVi
Static task
static1
Behavioral task
behavioral1
Sample
griefinsight.t.me.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
griefinsight.t.me.exe
Resource
win10ltsc2021-20241211-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://nearycrepso.shop/api
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
griefinsight.t.me.bin
-
Size
36.4MB
-
MD5
ccdff4b1fcc7f0bf1fee65fe759c2f63
-
SHA1
ab65ccb587e236a4efd13ed53da340cfc5390e5f
-
SHA256
bcd89261e8260d0498651bcf52a817cc6221c0c39e96c262d22c5006bff8894a
-
SHA512
2105b211bab0fb3778cbc8dcef757c937f65a5a1bb41233be902966ac4e093faf0b6d2f99299f669cd4c3709f9980efe60c20b19e51cddde500c4af0390a0d6d
-
SSDEEP
196608:XNQpKtZcrSXs7GljVyFlQlhTuoRIUckZP9aiUcm/6vjIKjLDpuxDJEvKoJIX1Udz:sOZgq5FMi5lLDK5tkrDEBA9Zj2PVi
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist
-