General

  • Target

    Set-up.exe

  • Size

    70.0MB

  • Sample

    250104-gpbj8awjgs

  • MD5

    49ed2f49b9cf4c5cded3906c247ecd75

  • SHA1

    57f4b2b8cb6310c0272c3d9ad50858abbcfbf7a9

  • SHA256

    835da839a33cf2fe0c98b0a69d90d6ba506f67b7e9bb3897b273abfc86a7c5e4

  • SHA512

    a5c0410f18702cb258ea0aa2242eaa638ac258c43f0d5549794f7253f285cc587fcf461812a96fa114ae88f4bb3fafeddc95b5a4b871546bf45a6c39da8533dd

  • SSDEEP

    12288:oClTmK/OHyQ0nUQL3xfbwfTsLPeh6BhEIaR6yZMwsQ/SZduLdgchrm+qNIolZN/Z:oITmIOMUQVjVPu6Bk6GrmpIoXNNp/1gg

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      Set-up.exe

    • Size

      70.0MB

    • MD5

      49ed2f49b9cf4c5cded3906c247ecd75

    • SHA1

      57f4b2b8cb6310c0272c3d9ad50858abbcfbf7a9

    • SHA256

      835da839a33cf2fe0c98b0a69d90d6ba506f67b7e9bb3897b273abfc86a7c5e4

    • SHA512

      a5c0410f18702cb258ea0aa2242eaa638ac258c43f0d5549794f7253f285cc587fcf461812a96fa114ae88f4bb3fafeddc95b5a4b871546bf45a6c39da8533dd

    • SSDEEP

      12288:oClTmK/OHyQ0nUQL3xfbwfTsLPeh6BhEIaR6yZMwsQ/SZduLdgchrm+qNIolZN/Z:oITmIOMUQVjVPu6Bk6GrmpIoXNNp/1gg

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks