lumma | db1487c37c9529b6a5f725e86930aa9a4f8d968d639b451ab40cb7d0a78f4aa4

General

Target

db1487c37c9529b6a5f725e86930aa9a4f8d968d639b451ab40cb7d0a78f4aa4N.exe
Size

795KB
Sample

250104-a3jpesvjem
MD5

25ba3643aeba292ec17184ab472ac400
SHA1

6d6a5eae870290763a5b72c49269d30dc053986d
SHA256

db1487c37c9529b6a5f725e86930aa9a4f8d968d639b451ab40cb7d0a78f4aa4
SHA512

806ad4342681fad69067a900d5d74c6b1820c42170e24463b62080241d56cc7b1b1d2f971ca170fb79647e0cfe96d29ff6d59313dd8cba7a35a424f674e5c3a9
SSDEEP

24576:Z4dPpQPmuebzhnacjknRa+2mebzhnacjknRa+2t:CdPp/uILkQ+XILkQ+A

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fancywaxxers.shop/api

Extracted

Family

lumma

C2

https://fancywaxxers.shop/api

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

- Target
  
  db1487c37c9529b6a5f725e86930aa9a4f8d968d639b451ab40cb7d0a78f4aa4N.exe
- Size
  
  795KB
- MD5
  
  25ba3643aeba292ec17184ab472ac400
- SHA1
  
  6d6a5eae870290763a5b72c49269d30dc053986d
- SHA256
  
  db1487c37c9529b6a5f725e86930aa9a4f8d968d639b451ab40cb7d0a78f4aa4
- SHA512
  
  806ad4342681fad69067a900d5d74c6b1820c42170e24463b62080241d56cc7b1b1d2f971ca170fb79647e0cfe96d29ff6d59313dd8cba7a35a424f674e5c3a9
- SSDEEP
  
  24576:Z4dPpQPmuebzhnacjknRa+2mebzhnacjknRa+2t:CdPp/uILkQ+XILkQ+A
Score

10^/10

discovery lumma stealer
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Lumma family
  lumma
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Lumma Stealer, LummaC

Lumma family

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2