General

  • Target

    infected.zip

  • Size

    4.4MB

  • Sample

    250105-q72nssyjej

  • MD5

    75ff2f69ae760632df3b2e64a2ddc0b3

  • SHA1

    25aacdb1cac577c4ce27db3489f710e3557152f3

  • SHA256

    a22c621e83aa560dc6db8b26ea1f1ae20dde8d275404bce11b5725be81f81e1e

  • SHA512

    898415ecf0aa5a3a1d2f3435d1e262c7da2d50b793ac20d6171d7c75baa3aef248cef75cb6b97a8acfef742f3f9e315703317bb1611e9f30e5561a2325253b2d

  • SSDEEP

    24576:3xpuctVJ3Ua4yv3s+sTNx4SU7MtxOvIcRwWNdVYXy/MpLaTbHLxbF:3v3J3Ua++sTNFtzcmqVYXeMMbF

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      Set-up.exe

    • Size

      920.0MB

    • MD5

      4c96501193eb66f09e1d36155f0862a8

    • SHA1

      6a3a2d9eb8ba565900b73f7b28f78b95ab542eca

    • SHA256

      fc97c31375b6c844e93c3b3ea811f1b199ecb55ae45a9137e7c2ffe1d298b544

    • SHA512

      310526c23eb0c46e694a263d4f64552ca5fd2191938f13eec0d982b727fd6aab44d47a99651cfc1d5c8b29206fd8cbdaeb08a18b79dcc16436b46e9bad01a83a

    • SSDEEP

      24576:DOHp0KPVf3iaW8bFE+OzNZ4yKLITxmNMu/WirL9m7k7opRaZjHM:wJf3iaM+OzN3TxuOW9m7goJ

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks