General

  • Target

    PASS-1234.zip

  • Size

    37.0MB

  • Sample

    250105-m7kthasmat

  • MD5

    65760834f3a039f72057f2debd91dd64

  • SHA1

    11027039cec72c0cdabb0a9ca8271f4bb2e7f3b2

  • SHA256

    a9f9d70ac11bceafc5b850cf44b959c2796a6b1c728f7a4e42fa09c0a87ef693

  • SHA512

    3295e82acd101b622301eecfbfe23b61f6137e6ce86190ded172afcbe3c0143205dd2849f208c5fc3692ec59485e4eca095101a7d7826ccecc2573eaf51cd638

  • SSDEEP

    786432:fnuq+CaDeprnuq+CaDepAnuq+CaDeplnuq+CaDepCnuq+CaDepXnuq+CaDepcnu6:G3Caap63CaapJ3CaapQ3CaapP3Caap+V

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      PASS-1234.zip

    • Size

      37.0MB

    • MD5

      65760834f3a039f72057f2debd91dd64

    • SHA1

      11027039cec72c0cdabb0a9ca8271f4bb2e7f3b2

    • SHA256

      a9f9d70ac11bceafc5b850cf44b959c2796a6b1c728f7a4e42fa09c0a87ef693

    • SHA512

      3295e82acd101b622301eecfbfe23b61f6137e6ce86190ded172afcbe3c0143205dd2849f208c5fc3692ec59485e4eca095101a7d7826ccecc2573eaf51cd638

    • SSDEEP

      786432:fnuq+CaDeprnuq+CaDepAnuq+CaDeplnuq+CaDepCnuq+CaDepXnuq+CaDepcnu6:G3Caap63CaapJ3CaapQ3CaapP3Caap+V

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks