Resubmissions

03-01-2025 03:28

250103-d1d8psxnfz 10

03-01-2025 00:59

250103-bcehfsspgt 10

03-01-2025 00:10

250103-agetcatrhp 10

02-01-2025 23:44

250102-3rc2qazphs 10

02-01-2025 23:34

250102-3khcvstjeq 10

02-01-2025 19:18

250102-xz8wgavphj 10

02-01-2025 04:32

250102-e57aqawlem 10

02-01-2025 04:20

250102-eybkgavrej 10

02-01-2025 04:14

250102-etyt7svpgq 10

02-01-2025 03:52

250102-efgnrstrgl 10

General

  • Target

    e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b.zip

  • Size

    3.6MB

  • Sample

    250102-efgnrstrgl

  • MD5

    f74893e7009466ecb114c6c0d358a1a8

  • SHA1

    d4f1a1453b614182a1a11bc37e07371acfe7a6e4

  • SHA256

    e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b

  • SHA512

    7761473f21a460db255e7311bd941135a599d8f086317046a07ba0b8b14f9d9d2521bbe060b2da17ef186664d009ae5af73db05bd4cdfbfca1b35f099f4399c2

  • SSDEEP

    49152:ANGlbHSzObWIuczmcrpK69aIosPidm5HRQLas:XlzwEWIuczmcrtosPidm5xEas

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      Setup.exe

    • Size

      800.0MB

    • MD5

      b4d4d19863fd8b7b64e2e8a1204aac62

    • SHA1

      64d1609b82e6054af14412a92724d8605b7d015d

    • SHA256

      56375ce34ece830c6770d768f1ed501a78c359a380c9576274dbbd19c9ef5aa3

    • SHA512

      e00fa8b5af32b334849e499f5f0be5a23aeb37ab2b28d2bf82cee2766d85c3fb1a874cd327467ebdd57475b2b42befb7507d2d6ac923020964e23f0a3f5a7bff

    • SSDEEP

      24576:KjatNrAGDrHrmxAztbD6Lf5aytZI9FmLaQWnnZp/fh+AR9wLsS9qB3Hcxx1VmLHA:PUGnHRbEau4FmUZpYARuISsV+VmLHRQl

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks