General
-
Target
stripped.exe
-
Size
24.1MB
-
Sample
250103-wnxhmayqcp
-
MD5
f26d14475af4cb8a7935eb6a690a7625
-
SHA1
5ca07ca27bf0b8d2caf64815eddddb42acd38e1b
-
SHA256
4990545df84ebd46c77f2b4093654af750dd760894ca9044cda754d0a0bc2ec1
-
SHA512
7e2621db99378a0d5b4b49fab2d3869002852a4380ddf46d5292230982b86214fb29dfac2669b48fb0b04c9dd93075b7af527791924e2c6907bfcd6d46aedbf6
-
SSDEEP
393216:gWRpCK8tTZqMmY2+YvgEcEkiShZw4N9E:gWRUK6mZCq
Static task
static1
Behavioral task
behavioral1
Sample
stripped.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
stripped.exe
-
Size
24.1MB
-
MD5
f26d14475af4cb8a7935eb6a690a7625
-
SHA1
5ca07ca27bf0b8d2caf64815eddddb42acd38e1b
-
SHA256
4990545df84ebd46c77f2b4093654af750dd760894ca9044cda754d0a0bc2ec1
-
SHA512
7e2621db99378a0d5b4b49fab2d3869002852a4380ddf46d5292230982b86214fb29dfac2669b48fb0b04c9dd93075b7af527791924e2c6907bfcd6d46aedbf6
-
SSDEEP
393216:gWRpCK8tTZqMmY2+YvgEcEkiShZw4N9E:gWRUK6mZCq
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-