General

  • Target

    installer_1.05_36.8.exe

  • Size

    1.1MB

  • Sample

    250106-r5ab7s1pam

  • MD5

    586c45b07a69a89813272e425388029f

  • SHA1

    979e0ccab38b87ac3d3d4c79a6a3d9351179df26

  • SHA256

    41fcac4067db860114a270ffadb6083647ed54bc95e43faf1fffbb23f0cf2a2b

  • SHA512

    b83a662985d4a1165e19bbbb52e10cbaefab972f8a8a5dd65a657b32c29a5d1b69f3c588c41469340538600ecc237a369b7dfca35cca18572511f2b997d1085e

  • SSDEEP

    24576:SGjZb7WC6n1V1ZkIppYCHKW0pPM5nhO9LI5mnx1+lEU/6Wx:3VK11Vr/ppdqWy05nkLI5mn7DUCWx

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://siffinisherz.sbs/api

Extracted

Family

lumma

C2

https://siffinisherz.sbs/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

Targets

    • Target

      installer_1.05_36.8.exe

    • Size

      1.1MB

    • MD5

      586c45b07a69a89813272e425388029f

    • SHA1

      979e0ccab38b87ac3d3d4c79a6a3d9351179df26

    • SHA256

      41fcac4067db860114a270ffadb6083647ed54bc95e43faf1fffbb23f0cf2a2b

    • SHA512

      b83a662985d4a1165e19bbbb52e10cbaefab972f8a8a5dd65a657b32c29a5d1b69f3c588c41469340538600ecc237a369b7dfca35cca18572511f2b997d1085e

    • SSDEEP

      24576:SGjZb7WC6n1V1ZkIppYCHKW0pPM5nhO9LI5mnx1+lEU/6Wx:3VK11Vr/ppdqWy05nkLI5mn7DUCWx

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks