General

  • Target

    fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136.zip

  • Size

    70.0MB

  • Sample

    250109-bqjpbs1rgz

  • MD5

    b882bcb81d94886f4a4ca2a6b9c82ed9

  • SHA1

    4dc7d523019dcfc7d18c7c3fd0bbae5bfa4183fe

  • SHA256

    fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136

  • SHA512

    16c9fd00b78bab60ed776a6fceda54f1ed7d7d452e85ddaecc77004e3d5e12fec5937154de1692d235c58c2a24e04b4808389d1ed61178414086ef6fe43c3058

  • SSDEEP

    24576:zZYGX5mWfodObJblG3uWkkCOo8PlfAQDCurRM5M+:1B5mWwdyNwfkEpV5uM+

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://miscreanntyj.cyou/api

Extracted

Family

lumma

C2

https://miscreanntyj.cyou/api

Targets

    • Target

      fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136.zip

    • Size

      70.0MB

    • MD5

      b882bcb81d94886f4a4ca2a6b9c82ed9

    • SHA1

      4dc7d523019dcfc7d18c7c3fd0bbae5bfa4183fe

    • SHA256

      fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136

    • SHA512

      16c9fd00b78bab60ed776a6fceda54f1ed7d7d452e85ddaecc77004e3d5e12fec5937154de1692d235c58c2a24e04b4808389d1ed61178414086ef6fe43c3058

    • SSDEEP

      24576:zZYGX5mWfodObJblG3uWkkCOo8PlfAQDCurRM5M+:1B5mWwdyNwfkEpV5uM+

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks