General
-
Target
Bootstrapper_v2,11.exe
-
Size
2.9MB
-
Sample
250103-wv22pazjej
-
MD5
6ba3f4d057686fee3f1f792df10d5869
-
SHA1
ade4a1ada7886ca1bd4c8d7d1d3cba62f9e018a1
-
SHA256
1aeba3aa813d2a63819a2051ff3a657cea022d4df5e6a6f88abe947d1db00177
-
SHA512
79e93fba04fbdcad41b2b45462ee4994e08d8a63eee9fad2713a2b886d8fb4f697c489150466c883c3b0e039b4922b709fd1dbd4bc882cb16b9d9efc139a2285
-
SSDEEP
49152:6lcyXfHnaBTof9ePCGkIAm1skqXfd+/9A9ByClY1v/a/ehH7pNLLn2W:YZXfHaFoZIvqkqXf0FglY1XOe97vLn
Static task
static1
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://fancywaxxers.shop/api
Extracted
lumma
https://fancywaxxers.shop/api
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
Bootstrapper_v2,11.exe
-
Size
2.9MB
-
MD5
6ba3f4d057686fee3f1f792df10d5869
-
SHA1
ade4a1ada7886ca1bd4c8d7d1d3cba62f9e018a1
-
SHA256
1aeba3aa813d2a63819a2051ff3a657cea022d4df5e6a6f88abe947d1db00177
-
SHA512
79e93fba04fbdcad41b2b45462ee4994e08d8a63eee9fad2713a2b886d8fb4f697c489150466c883c3b0e039b4922b709fd1dbd4bc882cb16b9d9efc139a2285
-
SSDEEP
49152:6lcyXfHnaBTof9ePCGkIAm1skqXfd+/9A9ByClY1v/a/ehH7pNLLn2W:YZXfHaFoZIvqkqXf0FglY1XOe97vLn
-
Lumma family
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-