General

  • Target

    sample

  • Size

    8KB

  • Sample

    250103-gjn85avlaj

  • MD5

    0f2de0643d876b3ce880071d54883532

  • SHA1

    74b878e6e8ffcd155ac7329d8beddf12bdeeb070

  • SHA256

    da2e51f95d10284844097530a1279933f70f961ffd51e09d02aae9be353e86c8

  • SHA512

    42e713cd218d065f8e66c9b398beb6a360cd3df219da6f5617545334ea3e34fa8bc3a3fdb27813b299fdfb53e28dbf11c0d84a7f77c6242f641e3982d040ace0

  • SSDEEP

    192:tlidPB/TRJ7HvI4M+lczFziW9z4B92z2Jn1pmM:IB7PHv/czFzi4z46zsn1pmM

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      sample

    • Size

      8KB

    • MD5

      0f2de0643d876b3ce880071d54883532

    • SHA1

      74b878e6e8ffcd155ac7329d8beddf12bdeeb070

    • SHA256

      da2e51f95d10284844097530a1279933f70f961ffd51e09d02aae9be353e86c8

    • SHA512

      42e713cd218d065f8e66c9b398beb6a360cd3df219da6f5617545334ea3e34fa8bc3a3fdb27813b299fdfb53e28dbf11c0d84a7f77c6242f641e3982d040ace0

    • SSDEEP

      192:tlidPB/TRJ7HvI4M+lczFziW9z4B92z2Jn1pmM:IB7PHv/czFzi4z46zsn1pmM

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • A potential corporate email address has been identified in the URL: [email protected]

MITRE ATT&CK Enterprise v15

Tasks