General

  • Target

    📂!𝓓𝓸𝔀𝓷𝓵𝓸𝓪𝓭🟆𝓕𝓲𝓵𝓮🟆𝓝𝓮𝔀_7890_🟆.zip

  • Size

    1.0MB

  • Sample

    250104-j7mfjstjcj

  • MD5

    362e06f8dcd21c7cf11f66ac7fb9cf8d

  • SHA1

    849c0e96dc94c8780c8a19a998b10fa36a6b15a8

  • SHA256

    ec11824478caa1b2a4946b762ffb8c6706ac67419706f49f275d84fe638cbafc

  • SHA512

    56a87ad5edfc65e5ab7d5f07fda5e1efc38ac2ed4a569760cea930a02ab61231fded004a9aa777b58f9f6de14aa7892ff580a845a3eaa320df535e5e957b906f

  • SSDEEP

    24576:xF3qb7U/pLrABkfNWqiBi9XW+w1G2KR7Gmk:xF3qb7IpLrAWF13G1G2K4r

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      SET_UP.exe

    • Size

      70.0MB

    • MD5

      7395facdf6855e6ffa5b3b7c8465ea6c

    • SHA1

      5b5296a4829a0954a375bdeb384bb581982611b4

    • SHA256

      f0c3c758ab20867c4c1fc663c94211270849dba9bf386a0d20d3ce9049eb875e

    • SHA512

      a7762a9a86183bb4056747e8f6539c82bc178de97575e8132cd44ed88633a25dddff8bb4da937b534568d922cd9d23813a20bed2cb984151adc2171702a88f7c

    • SSDEEP

      24576:NM/wwRvEpNfw/mwZ9ilkBXpFwaBf62u5zaoM5OA4bHJHBhz1wJaP3d3:XpNY/BiCzFwWo5moMIbHJfX3d3

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

    • Target

      Setup.exe

    • Size

      1.1MB

    • MD5

      f055691b21ccb5cf9cf213b8d1bc41f7

    • SHA1

      bdce3533a74a923851deb05ad94dc4ef911ded90

    • SHA256

      83499bef9c13f62673773813aed1d1b051866e6904183670040069686278c5d8

    • SHA512

      41b560661f79e60010aaef7ad6588a7f14dff26b462a4ecba2e726486d182916b651b595415320983cb3856b01b643bef08ba7e93e08901ccb3157e39075482f

    • SSDEEP

      24576:0M/wwRvEpNfw/mwZ9ilkBXpFwaBf62u5zaoM5OA4bHJHBhz1wJaP3w3:IpNY/BiCzFwWo5moMIbHJfX3w3

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks