Overview
overview
10Static
static
3ChatGPT-5 ...4 .exe
windows7-x64
5ChatGPT-5 ...4 .exe
windows10-2004-x64
10NL7Data0404.dll
windows7-x64
1NL7Data0404.dll
windows10-2004-x64
1NL7Models0804.dll
windows7-x64
1NL7Models0804.dll
windows10-2004-x64
1NlsData004a.dll
windows7-x64
1NlsData004a.dll
windows10-2004-x64
1General
-
Target
e1783c551610bce488e95409b7b30020abb19a1f0fdf305883da9de983b6b8dd.zip
-
Size
3.0MB
-
Sample
250107-amy46sxlej
-
MD5
ca44f6d10d96354dc77f736a9fb73710
-
SHA1
b0660fddb75022f2ec8df8c50c3bfcef6a43f97a
-
SHA256
e1783c551610bce488e95409b7b30020abb19a1f0fdf305883da9de983b6b8dd
-
SHA512
e860072f1d20ecbeeb0f13235a3d1ac0562c6915122a163d015e0a905a1a4fc530d651e4d6ae8986c5745a80f9f952109899d71cd952fde7ae463ed487acf5b6
-
SSDEEP
98304:Oyh8BvaBzaqkZaBoA6uR9a3tOYDFQpcIkMyWyp:OyWha0ZCgD9bvDM+
Static task
static1
Behavioral task
behavioral1
Sample
ChatGPT-5 Version 2024 .exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ChatGPT-5 Version 2024 .exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
NL7Data0404.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
NL7Data0404.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
NL7Models0804.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
NL7Models0804.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
NlsData004a.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
NlsData004a.dll
Resource
win10v2004-20241007-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://fancywaxxers.shop/api
Targets
-
-
Target
ChatGPT-5 Version 2024 .exe
-
Size
646KB
-
MD5
07feca81b29907ce6550288a7d2b8821
-
SHA1
6252d362fe96293254a1f284a95355440a2dc2cc
-
SHA256
eb28c83590f742bb8a12d01f4692421786b6a04dcf9fcc31df93de6d0068b717
-
SHA512
add0f86c572a83d4d2baa8a3d79db1ce321ae846aa02afe559abc91da0bd8ca6bd3969f4e75372ea606057436fc5e3353c71d23feef843340c41be9d0b72d800
-
SSDEEP
12288:J4CD99jUhaQS/Aby46x4YFFR5WQ/Ee4vbDAt8G+DiBezmm72kiz5iIrSEO:Osbkaqx6xDR5BEe4X2jnBeKPIt
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
-
-
Target
NL7Data0404.dll
-
Size
2.2MB
-
MD5
81b14fd1c9d2b830e55c93c4c38afa2f
-
SHA1
975bef050d9e8d2ee577e1b4db5dd6e2d67bff20
-
SHA256
878e2dbac4b6a6bcce54742f3c7bfd87aa93a6637cccc1e5d18ab65215d81bee
-
SHA512
16bcd415ca4cfc8813d990a304723a87122eede56a4f2c84b8fac91ccb0d5fd9c2db413358eecf145c1faad5b74f16b516a3c5e12f977bbca0cb6f66cc73d3ec
-
SSDEEP
24576:WckkkkkkHxKjbNX7UtOGwu1fg5tXVD539swzYNefx+Pff5pn3DXBdVjtxv/Ui:WeKYtOGwu1fg5FtJ9nMX5bL9z
Score1/10 -
-
-
Target
NL7Models0804.dll
-
Size
2.8MB
-
MD5
65525c7b89204d241120b7638934a0d2
-
SHA1
c7b20986b1c5cb76896d0fca167e02f6cbfb1fcf
-
SHA256
18f7f52f14986133f9a9676d5ab959349377a53c0936cea6eb9880e72f85bc54
-
SHA512
0e5c920a4c2b197b890a59bd56e54a49cf7167407aa2d1381abe5e2afaa646aa8524d145616ee370a4f95e0069baccff0ff616e60f598d47d2ce817f23f47fa1
-
SSDEEP
49152:uoUhaa1DcUEtVYi/WixQrZ/t6BvQZAbuW8X0VbBftuIIDyzwjWV2xK+RE30Y:Shaa1IXaJybnwG2xK2Y
Score1/10 -
-
-
Target
NlsData004a.dll
-
Size
3.1MB
-
MD5
be007b645b9d1332e3346107727320d9
-
SHA1
0717c6fea33ddd04b9f032039d23c66efd5e5f76
-
SHA256
7b128be8d77398cbc3bb789a34e21afc984c2e87276907a01326f8fb4504e9da
-
SHA512
8e205aaf5ef8a1e5259634ff51b1e0da8bf35ace547e01de05a02dd0ad55ef7a46329737ba062556c195ba0ef6e3722ea144752f0aa8330c440dac38b2653f82
-
SSDEEP
24576:oJEJNe9wndvrpof5UUv6ujcqJByewHXqQpiPlJKaTsO0KwRB3Q/CDuCF:k9CNofaXXqQpTawO0KwRB3Q/Au
Score1/10 -