General

  • Target

    1easyacid.zip

  • Size

    14.8MB

  • MD5

    1e64d7e08fdaa70104e0f0103fdc5b7b

  • SHA1

    075e65b3872e5060955e035c743cd8f375fff65d

  • SHA256

    1be130eb73f431227a9f44376468d2efdc30394a34ef182326adc5d42b367e0f

  • SHA512

    7421dd4bc60cbf77d5b9d61c454ffe0a4274c577f2530b3c4e3d4eab1599d365897c2d2196e3cbf8cc2a95dec53946fd4d0a99b65ad8aab379289625db1f6351

  • SSDEEP

    393216:eH2ekU5hOIOGAEvhB5qUyElaIu2SfFJJ9sqkH9y:eWekUhOi5qhX6H9y

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://spellshagey.biz/api

Signatures

  • Lumma family
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • 1easyacid.zip
    .zip

    Password: acid1

  • nokey_easy.zip
    .zip

    Password: acid1

  • acid88/bin/1ciaq/geoip.dat
  • acid88/bin/1ciaq/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    df1ed3ada0a928f700ff7d951cae6b48


    Headers

    Imports

    Exports

    Sections

  • acid88/bin/1ciaq/qsvgicon.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    acedae60834903d93be16474c3956450


    Headers

    Imports

    Exports

    Sections

  • acid88/bin/1ciaq/qtuiotouchplugin.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    4ed2c6808db7cec206f9eacc57044d4e


    Headers

    Imports

    Exports

    Sections

  • acid88/bin/1ciaq/qwindowsvistastyle.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    b5427a671f558e76a138c84df8c5c4cf


    Headers

    Imports

    Exports

    Sections

  • acid88/bin/PaintDotNet.Strings.3.resx
  • acid88/bin/Qt5WinExtras.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    305a2818bcbbe98ea06ae2866db77790


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acid88/bin/Qt5Xml.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    24d9a9d9da6c15ddc1476bd55d0caeea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acid88/bin/cjoaq/geosite.dat
  • acid88/bin/cjoaq/geosite.db
  • acid88/bin/cjoaq/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    Password: acid1

    df1ed3ada0a928f700ff7d951cae6b48


    Headers

    Imports

    Exports

    Sections

  • acid88/bin/cjoaq/qcertonlybackend.dll
    .dll windows:6 windows x64 arch:x64

    2abb5dc1169164e6b85fc54dbe001207


    Headers

    Imports

    Exports

    Sections

  • acid88/bin/cjoaq/qopensslbackend.dll
    .dll windows:6 windows x64 arch:x64

    a75634585888e5c62549f21d93efebe4


    Headers

    Imports

    Exports

    Sections

  • acid88/bin/cjoaq/qschannelbackend.dll
    .dll windows:6 windows x64 arch:x64

    a67823b9bd3b16d30fe357e339a2935f


    Headers

    Imports

    Exports

    Sections

  • acid88/bin/cjoaq/qtuiotouchplugin.dll
    .dll windows:6 windows x64 arch:x64

    4ed2c6808db7cec206f9eacc57044d4e


    Headers

    Imports

    Exports

    Sections

  • acid88/ez_acid.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • acid88/source/AvifNative_x64.dll
    .dll windows:6 windows x64 arch:x64

    1364952e1f3fdfd91bb75e96d6d3577e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acid88/source/MagixOFA_u_x64.dll
    .dll regsvr32 windows:6 windows x64 arch:x64

    2e9434d749dc79b845d0e966d5f00af2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acid88/source/RvROLClient.dll
    .dll windows:6 windows x86 arch:x86

    ddabd4310c1433b794008609f3cc7062


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acid88/source/RvUESClient.dll
    .dll windows:6 windows x86 arch:x86

    4cd40cfcd2567b094298dea0b4fb9699


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acid88/source/shelper.dll
    .dll windows:5 windows x86 arch:x86

    1ccb58c346cfdbea2a72089746034496


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • acid88/source/ucrtbase.dll
    .dll windows:10 windows x86 arch:x86

    71f1d8a10f840ffee6964317e974d463


    Code Sign

    Headers

    Imports

    Exports

    Sections