General

  • Target

    ReleaseX64.zip

  • Size

    3.0MB

  • Sample

    250104-hdz9waxlbx

  • MD5

    19dd193f8770746854b06f20070c6645

  • SHA1

    cd7d4639865ed5136d8fa654821d98e84af2ff5d

  • SHA256

    9ede6f41e425b63f515289220cbb8cf04142b65b176bf778fa2e1c763880dcf8

  • SHA512

    22b6e9aefc542193d985aeaee4cc803e7537926d895c417e29421fab3b7ed8e5e00694c563b9c5643c3159ad7d6ae33a16a5d2caff140ef0e5299bd43cc6d595

  • SSDEEP

    49152:4SqZs1iVtNTaL+Wl+LZr6ZiUZ5hWbSo6V+NgsgW2HiZtk/DBhGkls1coWf/sIKvU:xURtkaWlCZr695obg+NPj/kbzpb/OU

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      ReleaseX64.zip

    • Size

      3.0MB

    • MD5

      19dd193f8770746854b06f20070c6645

    • SHA1

      cd7d4639865ed5136d8fa654821d98e84af2ff5d

    • SHA256

      9ede6f41e425b63f515289220cbb8cf04142b65b176bf778fa2e1c763880dcf8

    • SHA512

      22b6e9aefc542193d985aeaee4cc803e7537926d895c417e29421fab3b7ed8e5e00694c563b9c5643c3159ad7d6ae33a16a5d2caff140ef0e5299bd43cc6d595

    • SSDEEP

      49152:4SqZs1iVtNTaL+Wl+LZr6ZiUZ5hWbSo6V+NgsgW2HiZtk/DBhGkls1coWf/sIKvU:xURtkaWlCZr695obg+NPj/kbzpb/OU

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks