General

  • Target

    277390a335bc7fccdea4527d016c5b572035936a5e6ab5372061a3f7a8dd73fd.zip

  • Size

    12.5MB

  • Sample

    250107-adaefsvkhs

  • MD5

    45e84223a86ec81bd780ea85985a2a48

  • SHA1

    b2c7cc92894d7e5ec5b6b05cb00f6a320cc8665f

  • SHA256

    277390a335bc7fccdea4527d016c5b572035936a5e6ab5372061a3f7a8dd73fd

  • SHA512

    604e37afd01d23d169a1e4e7375358ee6a75d891bc5523e14a940a08432dfbb3ee886e658772909e363e5116eabc033906ebcb503abcabc5b9df46a1485ceac0

  • SSDEEP

    393216:KaGVTmc5ET831bQQzYSER78quy9zJH/tfjM6q8T:tGVKc59FQQESER4qf9VHVfw6q8T

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Targets

    • Target

      jands vista 1024 channel dongle crack.exe

    • Size

      799.1MB

    • MD5

      372c7938ed89f650564273c9f7e95981

    • SHA1

      b5c8ac41d65d82f052bc52d000c1038545ee54cc

    • SHA256

      9f31b351f224ae42006da1b915dc51226e2727524457b5b5298334f0096e1fb1

    • SHA512

      acaa8e6b811d2261fb14f244412e60d7115fe1abd241b45903edaf8a6ab123f796aaa8770c7c6942ce9722eebee146fa2d1fdd0092787fa979522dbd2434e755

    • SSDEEP

      393216:TWRpCmLeSDdat3m3RJoEma8y7dQiSfaIRQVr4u:TWRUDY

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks