General

  • Target

    f7846a193c00e22d512fdc71fca6fb3f3af434179681d26700b11b7f4e69ab64N.exe

  • Size

    1.2MB

  • Sample

    250102-mej2hazqdk

  • MD5

    1b40450e11f71da7d6f3d9c025c078e0

  • SHA1

    5bdf461219e68aa7175a5fa01962af8e3f583c7e

  • SHA256

    f7846a193c00e22d512fdc71fca6fb3f3af434179681d26700b11b7f4e69ab64

  • SHA512

    bfb8dfa87aaf0dc9afd3ae19c6082a53917501899f582ddc10a56a311b9504a64f25c1b923abe0b5077cef64f6ef891089358d652e4a7618daca9418bad03017

  • SSDEEP

    24576:tI05w/i0EgOp2bAntruwSB/n5FqAmHrnaNWQu2/O7pOuSLBLX:tI05w/i0Ed2buawK/qAmLGWx7pOLLBz

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://framekgirus.shop/api

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      f7846a193c00e22d512fdc71fca6fb3f3af434179681d26700b11b7f4e69ab64N.exe

    • Size

      1.2MB

    • MD5

      1b40450e11f71da7d6f3d9c025c078e0

    • SHA1

      5bdf461219e68aa7175a5fa01962af8e3f583c7e

    • SHA256

      f7846a193c00e22d512fdc71fca6fb3f3af434179681d26700b11b7f4e69ab64

    • SHA512

      bfb8dfa87aaf0dc9afd3ae19c6082a53917501899f582ddc10a56a311b9504a64f25c1b923abe0b5077cef64f6ef891089358d652e4a7618daca9418bad03017

    • SSDEEP

      24576:tI05w/i0EgOp2bAntruwSB/n5FqAmHrnaNWQu2/O7pOuSLBLX:tI05w/i0Ed2buawK/qAmLGWx7pOLLBz

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks