General

  • Target

    Luna v1.1.rar

  • Size

    379KB

  • Sample

    241230-a5ztesslcm

  • MD5

    c68fec91ce7389805c5ce1656886c8f2

  • SHA1

    d3c4e004e11e96a78d8469c98c3552fef5de923d

  • SHA256

    c4a8a4398c83c1d76db8ea3106de2dfbdd5a7a273db3c0a3ea2dd36c14033f6d

  • SHA512

    06269d8d27c039dc9177a5d9dda7fff0627bb7d06cefc78e659febddf5367643c9f9b48f7f65253ff084b1fcef457fd394419d7d55ccd4d4786890a53eee3541

  • SSDEEP

    6144:LSh4YV9EoJ6NRzdQCqGPbH/P1tLoKsTw9DbVbeTk/ISbd6xNyEh+D:fYAoJ6NRB/NtLsTobVyToJqUT

Malware Config

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

Targets

    • Target

      Luna v1.1.exe

    • Size

      759KB

    • MD5

      a8703a974c525efa407ebd34fa64f2ce

    • SHA1

      a4e49acc7c6339a05e5e5ab4474136d5f8b448a4

    • SHA256

      aaf76b4bba6f51c8124821cbacf7faa925e51cc5f8850fa4b783ae58bb8b9522

    • SHA512

      088570a8f5ef7cc14d5b020f915b52c3d6115a5ed27a9b97a3ad7818d2405eaaef5bef025d1eb8c2518e036c168045cbc03b2121ad1da2efe0ec5a2b77dafc2a

    • SSDEEP

      12288:amOcxtujR/m8eHAPAHiqsz6GqBfMUyAj1Xwm8eHAPAHiqsz6GqBfMUyAj1Xylr7v:PGNmDH1SbuMYXwmDH1SbuMYXOr7v

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • A potential corporate email address has been identified in the URL: [email protected]

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks