General

  • Target

    df79d01ff30b464a4867a3c72599ab99592e6ed1cd8f4b4e5852f0cdff1a01bb.zip

  • Size

    12.5MB

  • Sample

    250107-acjazatrdy

  • MD5

    511caff37d5a605c2daadff422e5287d

  • SHA1

    176ebac1458f225537b8d50481083445ffd5bba8

  • SHA256

    df79d01ff30b464a4867a3c72599ab99592e6ed1cd8f4b4e5852f0cdff1a01bb

  • SHA512

    e539ce78c9530c47815247c134d8974975b1d6f798d2661cad52a94c97338c893aa58cfbb3ca0d45b02b45b4657c5a8a04e3ba61a20fdd1175b308b6749c53b0

  • SSDEEP

    393216:R6ZF29T4g88P173QLcMc/2gM6N1mCRNkls+wZgH:R6ZEhUIpQLch/JXNlDklsI

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Targets

    • Target

      tk file explorer 2.4.rar.exe

    • Size

      878.2MB

    • MD5

      adde4d5290ab83a130a8552f90cbee5e

    • SHA1

      eff7c626a7bd579728223a98fddc31dbc097bf22

    • SHA256

      008979dbd26066e3f38dc6ccb7ad115d949d610695ddd0712de3e20ee2d55ec0

    • SHA512

      3d4392735e47ddee9bde513a2548a09874026ba17cf9912679fd4f112ae479c117d0c1d081fba96d2960458d50882b48388534033644e9e91ecd774c077ebd9a

    • SSDEEP

      393216:mWRpCOLGye+zhsI+FLUhKJk6idDa0QPjj58kNt9:mWRUL7Lg68mH5j

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks