General
-
Target
fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136.zip
-
Size
70.0MB
-
Sample
250109-bqjpbs1rgz
-
MD5
b882bcb81d94886f4a4ca2a6b9c82ed9
-
SHA1
4dc7d523019dcfc7d18c7c3fd0bbae5bfa4183fe
-
SHA256
fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136
-
SHA512
16c9fd00b78bab60ed776a6fceda54f1ed7d7d452e85ddaecc77004e3d5e12fec5937154de1692d235c58c2a24e04b4808389d1ed61178414086ef6fe43c3058
-
SSDEEP
24576:zZYGX5mWfodObJblG3uWkkCOo8PlfAQDCurRM5M+:1B5mWwdyNwfkEpV5uM+
Static task
static1
Behavioral task
behavioral1
Sample
fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136.exe
Resource
win7-20241010-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://miscreanntyj.cyou/api
Extracted
lumma
https://miscreanntyj.cyou/api
Targets
-
-
Target
fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136.zip
-
Size
70.0MB
-
MD5
b882bcb81d94886f4a4ca2a6b9c82ed9
-
SHA1
4dc7d523019dcfc7d18c7c3fd0bbae5bfa4183fe
-
SHA256
fb3e0d7aa822c1027373e83e990b07da37dd9f184ef1762cac18c89160940136
-
SHA512
16c9fd00b78bab60ed776a6fceda54f1ed7d7d452e85ddaecc77004e3d5e12fec5937154de1692d235c58c2a24e04b4808389d1ed61178414086ef6fe43c3058
-
SSDEEP
24576:zZYGX5mWfodObJblG3uWkkCOo8PlfAQDCurRM5M+:1B5mWwdyNwfkEpV5uM+
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-