Overview

overview

10

Static

static

1

57bdd9c5ec...5b.msi

windows7-x64

10

57bdd9c5ec...5b.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57bdd9c5eca5fa517551038cefce58470fa011d1a461e9e4650d34918f23755b.zip

  • Size

    2.4MB

  • Sample

    241230-f6lwvazjaw

  • MD5

    896fb90e32e5ac077d7048884ba7aff9

  • SHA1

    dac99dae9ff264eaa302dbca0cecd42d78dfc94f

  • SHA256

    57bdd9c5eca5fa517551038cefce58470fa011d1a461e9e4650d34918f23755b

  • SHA512

    3eb744de0ed9ae0611486ac1bc654e227ce9a97b2b84cbc6dc5a72b9cac1b16204e7d4d34c5e5dd3500abdef81255ea694bf0c218f6d0c925d99f905337eecc7

  • SSDEEP

    49152:+k2GffEmyfZgElK2Th08HZVT0k5AiLUMUu+PhxiSFxT0kEpd:bffEmOZgElKEdZe3MoPhgSPT0ld

Score
10/10
lummadiscoverypersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      57bdd9c5eca5fa517551038cefce58470fa011d1a461e9e4650d34918f23755b.zip

    • Size

      2.4MB

    • MD5

      896fb90e32e5ac077d7048884ba7aff9

    • SHA1

      dac99dae9ff264eaa302dbca0cecd42d78dfc94f

    • SHA256

      57bdd9c5eca5fa517551038cefce58470fa011d1a461e9e4650d34918f23755b

    • SHA512

      3eb744de0ed9ae0611486ac1bc654e227ce9a97b2b84cbc6dc5a72b9cac1b16204e7d4d34c5e5dd3500abdef81255ea694bf0c218f6d0c925d99f905337eecc7

    • SSDEEP

      49152:+k2GffEmyfZgElK2Th08HZVT0k5AiLUMUu+PhxiSFxT0kEpd:bffEmOZgElKEdZe3MoPhgSPT0ld

    Score
    10/10
    lummadiscoverypersistenceprivilege_escalationstealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks