lumma | e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b

Target

e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b.zip
Size

3.6MB
Sample

250102-e57aqawlem
MD5

f74893e7009466ecb114c6c0d358a1a8
SHA1

d4f1a1453b614182a1a11bc37e07371acfe7a6e4
SHA256

e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b
SHA512

7761473f21a460db255e7311bd941135a599d8f086317046a07ba0b8b14f9d9d2521bbe060b2da17ef186664d009ae5af73db05bd4cdfbfca1b35f099f4399c2
SSDEEP

49152:ANGlbHSzObWIuczmcrpK69aIosPidm5HRQLas:XlzwEWIuczmcrtosPidm5xEas

Score

10^/10

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

- Target
  
  Setup.exe
- Size
  
  800.0MB
- MD5
  
  b4d4d19863fd8b7b64e2e8a1204aac62
- SHA1
  
  64d1609b82e6054af14412a92724d8605b7d015d
- SHA256
  
  56375ce34ece830c6770d768f1ed501a78c359a380c9576274dbbd19c9ef5aa3
- SHA512
  
  e00fa8b5af32b334849e499f5f0be5a23aeb37ab2b28d2bf82cee2766d85c3fb1a874cd327467ebdd57475b2b42befb7507d2d6ac923020964e23f0a3f5a7bff
- SSDEEP
  
  24576:KjatNrAGDrHrmxAztbD6Lf5aytZI9FmLaQWnnZp/fh+AR9wLsS9qB3Hcxx1VmLHA:PUGnHRbEau4FmUZpYARuISsV+VmLHRQl
Score

10^/10

lumma discovery stealer
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Lumma family
  lumma
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Targets

Lumma Stealer, LummaC

Lumma family

Checks computer location settings

Executes dropped EXE

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.