lumma | b0aeea5ea36e3f37e4766115d1412085d477b7fbd5c42b861c649df0bb1f20e9

General

Target

b0aeea5ea36e3f37e4766115d1412085d477b7fbd5c42b861c649df0bb1f20e9.exe
Size

828KB
Sample

241231-c9574szqbj
MD5

99dd1cbbd08be12b84138ba44f2c0c3c
SHA1

6ebe64007cfaef89253f61ce55c2ca4895b5ecf9
SHA256

b0aeea5ea36e3f37e4766115d1412085d477b7fbd5c42b861c649df0bb1f20e9
SHA512

a3e7af9de2f49b0698a8d933a9f70c99f4cbed554e51615e72089fc7ac8a3a24fe7f26f277e604d9a4fe39fbde25accdf7f3e7fd738547b7489080b9c71d6cc7
SSDEEP

12288:XZrquz8MsQ1S4jzdY7XO+Q3EYqUXh4dR4hSJBttj9wHV:XZrqkBc4jzl+QEf4hSJBtw

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fancywaxxers.shop/api

Extracted

Family

lumma

C2

https://fancywaxxers.shop/api

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

- Target
  
  b0aeea5ea36e3f37e4766115d1412085d477b7fbd5c42b861c649df0bb1f20e9.exe
- Size
  
  828KB
- MD5
  
  99dd1cbbd08be12b84138ba44f2c0c3c
- SHA1
  
  6ebe64007cfaef89253f61ce55c2ca4895b5ecf9
- SHA256
  
  b0aeea5ea36e3f37e4766115d1412085d477b7fbd5c42b861c649df0bb1f20e9
- SHA512
  
  a3e7af9de2f49b0698a8d933a9f70c99f4cbed554e51615e72089fc7ac8a3a24fe7f26f277e604d9a4fe39fbde25accdf7f3e7fd738547b7489080b9c71d6cc7
- SSDEEP
  
  12288:XZrquz8MsQ1S4jzdY7XO+Q3EYqUXh4dR4hSJBttj9wHV:XZrqkBc4jzl+QEf4hSJBtw
Score

10^/10

discovery lumma stealer
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Lumma family
  lumma
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Lumma Stealer, LummaC

Lumma family

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2