General
-
Target
PASS-1234.zip
-
Size
37.0MB
-
Sample
250105-m7kthasmat
-
MD5
65760834f3a039f72057f2debd91dd64
-
SHA1
11027039cec72c0cdabb0a9ca8271f4bb2e7f3b2
-
SHA256
a9f9d70ac11bceafc5b850cf44b959c2796a6b1c728f7a4e42fa09c0a87ef693
-
SHA512
3295e82acd101b622301eecfbfe23b61f6137e6ce86190ded172afcbe3c0143205dd2849f208c5fc3692ec59485e4eca095101a7d7826ccecc2573eaf51cd638
-
SSDEEP
786432:fnuq+CaDeprnuq+CaDepAnuq+CaDeplnuq+CaDepCnuq+CaDepXnuq+CaDepcnu6:G3Caap63CaapJ3CaapQ3CaapP3Caap+V
Static task
static1
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
PASS-1234.zip
-
Size
37.0MB
-
MD5
65760834f3a039f72057f2debd91dd64
-
SHA1
11027039cec72c0cdabb0a9ca8271f4bb2e7f3b2
-
SHA256
a9f9d70ac11bceafc5b850cf44b959c2796a6b1c728f7a4e42fa09c0a87ef693
-
SHA512
3295e82acd101b622301eecfbfe23b61f6137e6ce86190ded172afcbe3c0143205dd2849f208c5fc3692ec59485e4eca095101a7d7826ccecc2573eaf51cd638
-
SSDEEP
786432:fnuq+CaDeprnuq+CaDepAnuq+CaDeplnuq+CaDepCnuq+CaDepXnuq+CaDepcnu6:G3Caap63CaapJ3CaapQ3CaapP3Caap+V
-
Lumma family
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-