Overview

overview

10

Static

static

7

loader/loader.exe

windows7-x64

10

loader/loader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader1.zip

  • Size

    34.5MB

  • Sample

    250106-xlmfbavjcx

  • MD5

    8425203f717d3b43aab69e2169e287e9

  • SHA1

    12db69a1426b083f47c0a206bf64a8e71cb901c1

  • SHA256

    ecf3a39be3f3a39e64df404c81739c27ca31bff1143e4ec286b4574a3fded52c

  • SHA512

    f6a61629d4c018ea50213fe8d0f11bf3862e4689926c66e3dbf41bc37ff7b94102ee533accc9b9aad9d59324ac3290847979da5776f586a549af11dfccddbdb6

  • SSDEEP

    786432:wELl1Qasqsztsl9dMYAmIvVoNcTgWmqqldMLJN+vAYxeeYyAy+he/8f46:wEcvm9d4bTTgWmqcddAycNf46

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

Targets

    • Target

      loader/loader.exe

    • Size

      8.3MB

    • MD5

      fc218a603912062090c532efebbb92f1

    • SHA1

      6e345f5562f69e62db856399a481e4f9d58b9f96

    • SHA256

      234c2c325b0b34e822a6ba3c948cc485c73333bc7a0f8e71e05581256f1ec02c

    • SHA512

      643be57ca8f17e68bc2db7222511e3cc799f9a9d59e13b2359f3f661622c33313ecb957014454b45f1a055edd201c42680f76680e568344b08748925fca48439

    • SSDEEP

      6144:NhqNNoFApAi86VbQoxIT2PxsezS4uXveD5dSh7S2Hmd3iZApQkMIRYotM:NoNNmmPjVseIW6zXvelUBwVdxRYN

    Score
    10/10
    lummadiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks