Resubmissions

03/01/2025, 03:28

250103-d1d8psxnfz10

03/01/2025, 00:59

250103-bcehfsspgt10

03/01/2025, 00:10

250103-agetcatrhp10

02/01/2025, 23:44

250102-3rc2qazphs10

02/01/2025, 23:34

250102-3khcvstjeq10

02/01/2025, 19:18

250102-xz8wgavphj10

02/01/2025, 04:32

250102-e57aqawlem10

02/01/2025, 04:20

250102-eybkgavrej10

02/01/2025, 04:14

250102-etyt7svpgq10

02/01/2025, 03:52

250102-efgnrstrgl10

General

  • Target
    e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b.zip
  • Size 3.6MB
  • Sample250102-e57aqawlem
  • SHA256 e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • lumma

C2
  • https://cloudewahsj.shop/api

  • https://rabidcowse.shop/api

  • https://noisycuttej.shop/api

  • https://tirepublicerj.shop/api

  • https://framekgirus.shop/api

  • https://wholersorie.shop/api

  • https://abruptyopsn.shop/api

  • https://nearycrepso.shop/api

Extracted

Family
  • lumma

C2
  • https://abruptyopsn.shop/api

  • https://wholersorie.shop/api

  • https://framekgirus.shop/api

  • https://tirepublicerj.shop/api

  • https://noisycuttej.shop/api

  • https://rabidcowse.shop/api

  • https://cloudewahsj.shop/api

Targets

    • Target
      Setup.exe
    • Size 800.0MB
    • SHA256 56375ce34ece830c6770d768f1ed501a78c359a380c9576274dbbd19c9ef5aa3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks