lumma | c597b85d4313556ef7b17c4aff190e9decc760bee4d3d8a398e99c9631e2bfe7

General

Target

c597b85d4313556ef7b17c4aff190e9decc760bee4d3d8a398e99c9631e2bfe7
Size

130KB
Sample

250103-dxg57azqdr
MD5

260316dc9c13f2ff2c42553d902154d7
SHA1

1a05255e58aee30fab78612780c7e95a1b8221dd
SHA256

c597b85d4313556ef7b17c4aff190e9decc760bee4d3d8a398e99c9631e2bfe7
SHA512

8937c18fb413ae0020f6fa483811c5c614267c78a52f7cfab6847936d83b5166207e2445dc52729d5c2e05d35da0c926b4612025072296cb42fd1aca4f98d0cb
SSDEEP

3072:nf1BDZ0kVB67Duw9AMcmbvUFAjrYEOnEjbWicBGIgPjzgw0XIu0I/2jA+:n9X0G4vljrkJiUgPH/ubX+

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
193.149.189.199
Port:
21
Username:
LUM
Password:
159753

Extracted

Credentials

Protocol: ftp
Host:
193.149.189.199
Port:
21
Username:
ins
Password:
installer

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://acceptbaleeri.shop/api

Extracted

Family

lumma

C2

https://acceptbaleeri.shop/api

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

- Target
  
  c597b85d4313556ef7b17c4aff190e9decc760bee4d3d8a398e99c9631e2bfe7
- Size
  
  130KB
- MD5
  
  260316dc9c13f2ff2c42553d902154d7
- SHA1
  
  1a05255e58aee30fab78612780c7e95a1b8221dd
- SHA256
  
  c597b85d4313556ef7b17c4aff190e9decc760bee4d3d8a398e99c9631e2bfe7
- SHA512
  
  8937c18fb413ae0020f6fa483811c5c614267c78a52f7cfab6847936d83b5166207e2445dc52729d5c2e05d35da0c926b4612025072296cb42fd1aca4f98d0cb
- SSDEEP
  
  3072:nf1BDZ0kVB67Duw9AMcmbvUFAjrYEOnEjbWicBGIgPjzgw0XIu0I/2jA+:n9X0G4vljrkJiUgPH/ubX+
Score

10^/10

lumma discovery persistence stealer
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Lumma family
  lumma
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/InetLoad.dll
- Size
  
  18KB
- MD5
  
  994669c5737b25c26642c94180e92fa2
- SHA1
  
  d8a1836914a446b0e06881ce1be8631554adafde
- SHA256
  
  bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
- SHA512
  
  d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
- SSDEEP
  
  384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/ZipDLL.dll
- Size
  
  163KB
- MD5
  
  2dc35ddcabcb2b24919b9afae4ec3091
- SHA1
  
  9eeed33c3abc656353a7ebd1c66af38cccadd939
- SHA256
  
  6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
- SHA512
  
  0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
- SSDEEP
  
  3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
Score

3^/10

discovery
behavioral5 behavioral6