General

  • Target

    setup.exe

  • Size

    800.0MB

  • Sample

    250102-fs6n4axmap

  • MD5

    d9651f2beca94a8217305e5c58dec324

  • SHA1

    2af03bf8d7208aa997252a9751c5606540bfddf7

  • SHA256

    067b951700c4bcd09c80108c86d7f50abd040098e329e0d6caf570bea6db62fe

  • SHA512

    9a587c1b74f145f3bb9858620b2602e5d669dfef55238f930672c85cb703715c17fe966aef09261a8dbc16ff90c93297d352771838a957e252c5cab56048a891

  • SSDEEP

    24576:6uHsUZTV5bEBGdPbXa1iYkQPWX2BfBWpj+IBwfrhn1vJ:RQYdPbXa1Pkp2jMXefrhtJ

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      setup.exe

    • Size

      800.0MB

    • MD5

      d9651f2beca94a8217305e5c58dec324

    • SHA1

      2af03bf8d7208aa997252a9751c5606540bfddf7

    • SHA256

      067b951700c4bcd09c80108c86d7f50abd040098e329e0d6caf570bea6db62fe

    • SHA512

      9a587c1b74f145f3bb9858620b2602e5d669dfef55238f930672c85cb703715c17fe966aef09261a8dbc16ff90c93297d352771838a957e252c5cab56048a891

    • SSDEEP

      24576:6uHsUZTV5bEBGdPbXa1iYkQPWX2BfBWpj+IBwfrhn1vJ:RQYdPbXa1Pkp2jMXefrhtJ

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks