General
-
Target
infected.zip
-
Size
4.4MB
-
Sample
250105-q72nssyjej
-
MD5
75ff2f69ae760632df3b2e64a2ddc0b3
-
SHA1
25aacdb1cac577c4ce27db3489f710e3557152f3
-
SHA256
a22c621e83aa560dc6db8b26ea1f1ae20dde8d275404bce11b5725be81f81e1e
-
SHA512
898415ecf0aa5a3a1d2f3435d1e262c7da2d50b793ac20d6171d7c75baa3aef248cef75cb6b97a8acfef742f3f9e315703317bb1611e9f30e5561a2325253b2d
-
SSDEEP
24576:3xpuctVJ3Ua4yv3s+sTNx4SU7MtxOvIcRwWNdVYXy/MpLaTbHLxbF:3v3J3Ua++sTNFtzcmqVYXeMMbF
Static task
static1
Behavioral task
behavioral1
Sample
Set-up.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
Set-up.exe
-
Size
920.0MB
-
MD5
4c96501193eb66f09e1d36155f0862a8
-
SHA1
6a3a2d9eb8ba565900b73f7b28f78b95ab542eca
-
SHA256
fc97c31375b6c844e93c3b3ea811f1b199ecb55ae45a9137e7c2ffe1d298b544
-
SHA512
310526c23eb0c46e694a263d4f64552ca5fd2191938f13eec0d982b727fd6aab44d47a99651cfc1d5c8b29206fd8cbdaeb08a18b79dcc16436b46e9bad01a83a
-
SSDEEP
24576:DOHp0KPVf3iaW8bFE+OzNZ4yKLITxmNMu/WirL9m7k7opRaZjHM:wJf3iaM+OzN3TxuOW9m7goJ
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-