General

  • Target

    dfd1d227e9909a7cd5ee36f18ccd767687a77f7443c05d167143ce7ca4387fa1.zip

  • Size

    8.0MB

  • MD5

    bf53beb15986504621b980f0affba0f4

  • SHA1

    4d1b2f778a3df53f29fa7e0f4096689f795dfe14

  • SHA256

    dfd1d227e9909a7cd5ee36f18ccd767687a77f7443c05d167143ce7ca4387fa1

  • SHA512

    614c3ba4b533b1cd879643957f61f4f17ede129ccb1b0e99db38880191372ff9f8997970a40ef1c7ddf9cf949311a1a95155c500e2e82bcc1ac23cba3718c958

  • SSDEEP

    196608:YvSSBNuBTjmV7ZjKxazKgufDmONwS/tVWCiyCxpzPhfby1nX/:TSCmV2XgMDDH/7SyCx5hfC/

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

  • Lumma family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • dfd1d227e9909a7cd5ee36f18ccd767687a77f7443c05d167143ce7ca4387fa1.zip
    .zip

    Password: infected

  • CrosshairX.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • D3Dcompiler_47.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    f63cad154afed6da772d0ab361f448f6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • LICENSE.txt
  • Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    5dc4b26565969216fe39584905c80ce1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    8f734ad2a2d1a7b5910aa87f16fd104e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Network.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    1cd41c0abd9e652b8c20ad73c41f45e2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Svg.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    70d4f037a0ab67cbe75e5358a3f3386f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    b9416204924b28aa8c96be9645643488


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • README.md
  • WindowsManager.dll