General

  • Target

    appFile.zip

  • Size

    23.2MB

  • Sample

    241230-wrfdhsvlhv

  • MD5

    9e86a1aa05ec546821ac427ae7db94ab

  • SHA1

    0f291a4c9138a0050a319594d21e0747cf9f5e7e

  • SHA256

    eb7b3c2c8650ade52028043bfbae2e81ca69ffe6f931e10768bd5ea9d023904a

  • SHA512

    6ebc659962c2f0c42c00a3ee3e0ed7213a29ee103b502831549318beae2325aaddbcdd5354ddc8475cf3b5f5d293ed3dc0d0c553381c81a791a5912e9cd91aa7

  • SSDEEP

    393216:FwM5SkyPmpdEHwplDEEySATQMBsiLJJhnZ1zMKv20h6KzKxajZEmq1UBqCP:L50PEEIlDE3BfBM62UzKA1VFlP

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      appFile.exe

    • Size

      806.3MB

    • MD5

      b0518520d82a12f8499848740a629f79

    • SHA1

      5b0f1685153507ea5fdc9ac1aeb4bbb269c49ce1

    • SHA256

      51f3c1fc1f2c8b8742d9a7123efca47e5addbeede995de89917c73a26b14363a

    • SHA512

      3383ac77fa43bf5d4e63e961fb8563d27f9be245db601a1af824f1f32caa64efb02f6528bc4b8e46e864a5e1532e598958a1feb86a228e75c28f707cb9dfc484

    • SSDEEP

      393216:gYA50zAlgee1493WJE0YMk+yJm/Aqhem1f3:G5hxJS

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks