General

  • Target

    JaffaCakes118_2adc5e3648a7701933af6854b3f1a58fffaafcce15d04066e45db675f209ec7c

  • Size

    689.0MB

  • Sample

    241230-vreljszrhm

  • MD5

    3360b0df3f7e0f6a2a0c44f1f22d7fe5

  • SHA1

    b3726ba86f1b05d8955df3ca488036591e5b255c

  • SHA256

    2adc5e3648a7701933af6854b3f1a58fffaafcce15d04066e45db675f209ec7c

  • SHA512

    10a8e2891f376f5e028449879db9f237cd0952620332565d2ef19670fcbcbb51c55b086026c7c7880f176c1a92fe8cb9cc4fddbfb85e76fdb5a91e6e14aa534d

  • SSDEEP

    24576:2mI2o2pTKK50KKgv9O3NjYBWdtGTkyuGedY:gIFKYc3RY0yTkIeu

Malware Config

Extracted

Family

lumma

C2

82.118.23.50

Targets

    • Target

      JaffaCakes118_2adc5e3648a7701933af6854b3f1a58fffaafcce15d04066e45db675f209ec7c

    • Size

      689.0MB

    • MD5

      3360b0df3f7e0f6a2a0c44f1f22d7fe5

    • SHA1

      b3726ba86f1b05d8955df3ca488036591e5b255c

    • SHA256

      2adc5e3648a7701933af6854b3f1a58fffaafcce15d04066e45db675f209ec7c

    • SHA512

      10a8e2891f376f5e028449879db9f237cd0952620332565d2ef19670fcbcbb51c55b086026c7c7880f176c1a92fe8cb9cc4fddbfb85e76fdb5a91e6e14aa534d

    • SSDEEP

      24576:2mI2o2pTKK50KKgv9O3NjYBWdtGTkyuGedY:gIFKYc3RY0yTkIeu

    • Detect Lumma Stealer payload V2

    • Detect Lumma Stealer payload V4

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks