General
-
Target
00b9d1d9fdecf5c56035cd90461a9a3a93d74b588d203253b2698c64eddcb447
-
Size
70.0MB
-
Sample
250108-qbmj1atkap
-
MD5
062791084ec4605d7bbacf1105f5b885
-
SHA1
dc68b7eb995dc6462016e18c90fb5ecb2311e290
-
SHA256
00b9d1d9fdecf5c56035cd90461a9a3a93d74b588d203253b2698c64eddcb447
-
SHA512
a5ecbe3995ed230fc92ecb9e0566a36bd7c7ee26e160952b94c694ec6cedb4359366aee0e9fa4c404f05f4c64b70fa6bff0578f24f77f1501d5ae4af4c1a0a67
-
SSDEEP
24576:PcdAO+ciGEFSv5osh93ZkB0CMBR3EkuKrpXSsfN1htUIyDcOc7O7g:kMGNhBWK5BR3EkZNp1yDcx
Static task
static1
Behavioral task
behavioral1
Sample
00b9d1d9fdecf5c56035cd90461a9a3a93d74b588d203253b2698c64eddcb447.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://preside-comforter.sbs/api
https://savvy-steereo.sbs/api
https://copper-replace.sbs/api
https://record-envyp.sbs/api
https://slam-whipp.sbs/api
https://wrench-creter.sbs/api
https://looky-marked.sbs/api
https://plastic-mitten.sbs/api
https://lumharmonyfields.shop/api
Targets
-
-
Target
00b9d1d9fdecf5c56035cd90461a9a3a93d74b588d203253b2698c64eddcb447
-
Size
70.0MB
-
MD5
062791084ec4605d7bbacf1105f5b885
-
SHA1
dc68b7eb995dc6462016e18c90fb5ecb2311e290
-
SHA256
00b9d1d9fdecf5c56035cd90461a9a3a93d74b588d203253b2698c64eddcb447
-
SHA512
a5ecbe3995ed230fc92ecb9e0566a36bd7c7ee26e160952b94c694ec6cedb4359366aee0e9fa4c404f05f4c64b70fa6bff0578f24f77f1501d5ae4af4c1a0a67
-
SSDEEP
24576:PcdAO+ciGEFSv5osh93ZkB0CMBR3EkuKrpXSsfN1htUIyDcOc7O7g:kMGNhBWK5BR3EkZNp1yDcx
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-