General

  • Target

    d9ea1ecca8310eb6d3fcfb57bd8419e99da8a52ff787681d12fffe57522bf0c9.zip

  • Size

    351KB

  • Sample

    250107-accs7awnbq

  • MD5

    6c773ba78433905113bb5b7ef8f0a65e

  • SHA1

    aa1d44fc057bea9be9f5e6af682e99b5012fc1ed

  • SHA256

    d9ea1ecca8310eb6d3fcfb57bd8419e99da8a52ff787681d12fffe57522bf0c9

  • SHA512

    fa68b94f1dfdeeb771c8ae6e47cbca94216a04f57a7cb154553a1c4a83bf2935fab168c8383a352fe880964c67d9f6260b924f3cdc24eb627b01903de7a9420b

  • SSDEEP

    6144:BkxvJ/ERkS80GQ22speQuMyRNDXtetrJBq5Y5f19Blms5HU7I3JJ4Env:BkxxMuS8Z2sppu/RudJBN5dpp07I3H4+

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Targets

    • Target

      d9ea1ecca8310eb6d3fcfb57bd8419e99da8a52ff787681d12fffe57522bf0c9.zip

    • Size

      351KB

    • MD5

      6c773ba78433905113bb5b7ef8f0a65e

    • SHA1

      aa1d44fc057bea9be9f5e6af682e99b5012fc1ed

    • SHA256

      d9ea1ecca8310eb6d3fcfb57bd8419e99da8a52ff787681d12fffe57522bf0c9

    • SHA512

      fa68b94f1dfdeeb771c8ae6e47cbca94216a04f57a7cb154553a1c4a83bf2935fab168c8383a352fe880964c67d9f6260b924f3cdc24eb627b01903de7a9420b

    • SSDEEP

      6144:BkxvJ/ERkS80GQ22speQuMyRNDXtetrJBq5Y5f19Blms5HU7I3JJ4Env:BkxxMuS8Z2sppu/RudJBN5dpp07I3H4+

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks