General

  • Target

    Bootstrapper_v2,11.exe

  • Size

    2.9MB

  • Sample

    250103-wv22pazjej

  • MD5

    6ba3f4d057686fee3f1f792df10d5869

  • SHA1

    ade4a1ada7886ca1bd4c8d7d1d3cba62f9e018a1

  • SHA256

    1aeba3aa813d2a63819a2051ff3a657cea022d4df5e6a6f88abe947d1db00177

  • SHA512

    79e93fba04fbdcad41b2b45462ee4994e08d8a63eee9fad2713a2b886d8fb4f697c489150466c883c3b0e039b4922b709fd1dbd4bc882cb16b9d9efc139a2285

  • SSDEEP

    49152:6lcyXfHnaBTof9ePCGkIAm1skqXfd+/9A9ByClY1v/a/ehH7pNLLn2W:YZXfHaFoZIvqkqXf0FglY1XOe97vLn

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fancywaxxers.shop/api

Extracted

Family

lumma

C2

https://fancywaxxers.shop/api

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      Bootstrapper_v2,11.exe

    • Size

      2.9MB

    • MD5

      6ba3f4d057686fee3f1f792df10d5869

    • SHA1

      ade4a1ada7886ca1bd4c8d7d1d3cba62f9e018a1

    • SHA256

      1aeba3aa813d2a63819a2051ff3a657cea022d4df5e6a6f88abe947d1db00177

    • SHA512

      79e93fba04fbdcad41b2b45462ee4994e08d8a63eee9fad2713a2b886d8fb4f697c489150466c883c3b0e039b4922b709fd1dbd4bc882cb16b9d9efc139a2285

    • SSDEEP

      49152:6lcyXfHnaBTof9ePCGkIAm1skqXfd+/9A9ByClY1v/a/ehH7pNLLn2W:YZXfHaFoZIvqkqXf0FglY1XOe97vLn

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks