General
-
Target
PASS-1234.exe
-
Size
744KB
-
Sample
241231-ty6g6s1mhn
-
MD5
cf15f3e3576d512cf0696d4035212451
-
SHA1
b9d2ae2405dbd77d4d6c226589990872319f98ce
-
SHA256
3114e7c13f6545c7cb73343fbcb4ec4b0648751091d796f7923b17818603fb36
-
SHA512
2b1d8a5a5f24768c6a733af9393376e533958719de452f34d88496f98cc600efc7ab94e57a23e57326d4106e978a5a24721ee633d1e498dedc6c9e949a0a83c8
-
SSDEEP
12288:J8t1vT9z4WJ7lM3us92O7naDBKKnTur1AOy56/NlbFLJkG3Oa4j3cEsjp2LMVmAL:J45zzBi96Djo1QU/rFLS4Src
Static task
static1
Behavioral task
behavioral1
Sample
PASS-1234.exe
Resource
win7-20241010-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
PASS-1234.exe
-
Size
744KB
-
MD5
cf15f3e3576d512cf0696d4035212451
-
SHA1
b9d2ae2405dbd77d4d6c226589990872319f98ce
-
SHA256
3114e7c13f6545c7cb73343fbcb4ec4b0648751091d796f7923b17818603fb36
-
SHA512
2b1d8a5a5f24768c6a733af9393376e533958719de452f34d88496f98cc600efc7ab94e57a23e57326d4106e978a5a24721ee633d1e498dedc6c9e949a0a83c8
-
SSDEEP
12288:J8t1vT9z4WJ7lM3us92O7naDBKKnTur1AOy56/NlbFLJkG3Oa4j3cEsjp2LMVmAL:J45zzBi96Djo1QU/rFLS4Src
-
Lumma family
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-