General

  • Target

    4bef4d9f4dd6c612e56dbf81ea5ff2ea8be8901ad5b2a7aaa51b40a03fc7fd6e.zip

  • Size

    19.8MB

  • Sample

    241230-f65c7azkgk

  • MD5

    77de373a19b0561dfe4f60d1bac7a004

  • SHA1

    708e2c04b71bd4bdc88adbc5b9129df97d739962

  • SHA256

    4bef4d9f4dd6c612e56dbf81ea5ff2ea8be8901ad5b2a7aaa51b40a03fc7fd6e

  • SHA512

    8d4ae6904392ae7e733e82d53ba56766afe2e38b84a0f126735b83b687a1ce04fb1d26f6f091a25d5ee99be6e6baba50722d125ade6f08d8875fcc9873329b16

  • SSDEEP

    393216:nvXyiHz08ohp+0fwwngXZAHNa+YVBW8HGdWSyAIt3jYM0K+Z:nvXbTOdfwwnwQmkeGg1AI6c4

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://reinfomarbke.site/api

https://monopuncdz.site/api

https://unityshootsz.site/api

https://moeventmynz.site/api

https://plaintifuf.site/api

https://honerstyzu.site/api

https://bringlanejk.site/api

https://uppermixturyz.site/api

https://studentyjw.cyou/api

Targets

    • Target

      passport photo maker crack.exe

    • Size

      861.0MB

    • MD5

      9f262f9126360acc2a1c656d7d89972e

    • SHA1

      fb7aef14e46848a5c1c9557364be682225bb101d

    • SHA256

      3baa74a2f11da5bf188edd8f7b536351cb83360be191103af3393210b79dbf23

    • SHA512

      e3af5347507cc0375b0de76a551d4724dda5a78422bedb3445f903b59c65812e28b1a50f9056e52d2ea0a108c028cb92f61525ff443ff1636da92064195373ed

    • SSDEEP

      786432:olOmO9eLkRYK0dxf41GsJKngQO1rLoEt1XOi0IGdlkIVxnRkT:olOmCoW3oE31clxxnRkT

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks