Resubmissions
03-01-2025 03:28
250103-d1d8psxnfz 1003-01-2025 00:59
250103-bcehfsspgt 1003-01-2025 00:10
250103-agetcatrhp 1002-01-2025 23:44
250102-3rc2qazphs 1002-01-2025 23:34
250102-3khcvstjeq 1002-01-2025 19:18
250102-xz8wgavphj 1002-01-2025 04:32
250102-e57aqawlem 1002-01-2025 04:20
250102-eybkgavrej 1002-01-2025 04:14
250102-etyt7svpgq 1002-01-2025 03:52
250102-efgnrstrgl 10General
-
Target
e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b.zip
-
Size
3.6MB
-
Sample
250103-agetcatrhp
-
MD5
f74893e7009466ecb114c6c0d358a1a8
-
SHA1
d4f1a1453b614182a1a11bc37e07371acfe7a6e4
-
SHA256
e63a3eacf67cc313a4639ef19f78d6947af9c1210b5775158ddf95c6d5c9552b
-
SHA512
7761473f21a460db255e7311bd941135a599d8f086317046a07ba0b8b14f9d9d2521bbe060b2da17ef186664d009ae5af73db05bd4cdfbfca1b35f099f4399c2
-
SSDEEP
49152:ANGlbHSzObWIuczmcrpK69aIosPidm5HRQLas:XlzwEWIuczmcrtosPidm5xEas
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
Setup.exe
-
Size
800.0MB
-
MD5
b4d4d19863fd8b7b64e2e8a1204aac62
-
SHA1
64d1609b82e6054af14412a92724d8605b7d015d
-
SHA256
56375ce34ece830c6770d768f1ed501a78c359a380c9576274dbbd19c9ef5aa3
-
SHA512
e00fa8b5af32b334849e499f5f0be5a23aeb37ab2b28d2bf82cee2766d85c3fb1a874cd327467ebdd57475b2b42befb7507d2d6ac923020964e23f0a3f5a7bff
-
SSDEEP
24576:KjatNrAGDrHrmxAztbD6Lf5aytZI9FmLaQWnnZp/fh+AR9wLsS9qB3Hcxx1VmLHA:PUGnHRbEau4FmUZpYARuISsV+VmLHRQl
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist
-