Overview

overview

10

Static

static

3

e1db1b6bf9...b5.dll

windows7-x64

10

e1db1b6bf9...b5.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1db1b6bf9eab2058e82a23b0d3b0c3f330031faadfe1543c70cf3d6e376c1b5

  • Size

    12.6MB

  • Sample

    250103-d4xt8a1jhq

  • MD5

    3ece60696919a5cbf74e1cdec92b70ad

  • SHA1

    a806c22fcb6f00feedb2c74d51c4e8096dabacb6

  • SHA256

    e1db1b6bf9eab2058e82a23b0d3b0c3f330031faadfe1543c70cf3d6e376c1b5

  • SHA512

    8e5d34fdc92fc6bb41030e1b1ea5d3ea25accf089b926bc3898ce7423a7e15340e6b9ccdf477a1c3643ff069b18e724886a518e9c124981125a20f456fdaf6c2

  • SSDEEP

    393216:HUbvFw+aSYUTqC5U/Ox56rTn5B13DMP0X:Hn+aLUTAU5mTn5z3DMP0X

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      e1db1b6bf9eab2058e82a23b0d3b0c3f330031faadfe1543c70cf3d6e376c1b5

    • Size

      12.6MB

    • MD5

      3ece60696919a5cbf74e1cdec92b70ad

    • SHA1

      a806c22fcb6f00feedb2c74d51c4e8096dabacb6

    • SHA256

      e1db1b6bf9eab2058e82a23b0d3b0c3f330031faadfe1543c70cf3d6e376c1b5

    • SHA512

      8e5d34fdc92fc6bb41030e1b1ea5d3ea25accf089b926bc3898ce7423a7e15340e6b9ccdf477a1c3643ff069b18e724886a518e9c124981125a20f456fdaf6c2

    • SSDEEP

      393216:HUbvFw+aSYUTqC5U/Ox56rTn5B13DMP0X:Hn+aLUTAU5mTn5z3DMP0X

    Score
    10/10
    lummadiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks