General
-
Target
Setup.zip
-
Size
126.7MB
-
Sample
250104-cxrh7ayngn
-
MD5
307e7ca23242f65e49887e5455723410
-
SHA1
834501fda42e01480a23a2894491b7e49ae43c5f
-
SHA256
98c7ed12a9c8f8c8c4b321fe8b1f0111387961c365a2e053a2a13414cd53a2e0
-
SHA512
de97238b2a2b41e32241246a59befa9b3b92cb0e5146386cdab845809fe43be2bb6c42eba15db61eadec72c393a915b711998aa7e96333f3cec50ff56ddd9811
-
SSDEEP
3145728:PHBH4iP9KG0LJz4RESbbveTg4rG50sTMHO3lzgW:pHxVK3LJCDGg4rGnMIV
Static task
static1
Behavioral task
behavioral1
Sample
Setup.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Setup.zip
Resource
win10v2004-20241007-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://fancywaxxers.shop/api
Extracted
lumma
https://fancywaxxers.shop/api
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
Setup.zip
-
Size
126.7MB
-
MD5
307e7ca23242f65e49887e5455723410
-
SHA1
834501fda42e01480a23a2894491b7e49ae43c5f
-
SHA256
98c7ed12a9c8f8c8c4b321fe8b1f0111387961c365a2e053a2a13414cd53a2e0
-
SHA512
de97238b2a2b41e32241246a59befa9b3b92cb0e5146386cdab845809fe43be2bb6c42eba15db61eadec72c393a915b711998aa7e96333f3cec50ff56ddd9811
-
SSDEEP
3145728:PHBH4iP9KG0LJz4RESbbveTg4rG50sTMHO3lzgW:pHxVK3LJCDGg4rGnMIV
Score10/10-
Lumma family
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-