General
-
Target
https://download1527.mediafire.com/gvdsy9q4ly4gyWlzsR6kjz_C3Sn1ZLNzXtZNp7oTwtBCP5giLbnfSZaeNO1SDZwym_oJeoL9VMQ1m9X1AMmJ04c6pcwlYEAEenAAdvfeenwVV8zfXRVEgepGjZ40-5ZXZYNxXorO2ibTS5X1abHtUdS-_njuQqK2qsQVbScdgq0LSVc/0lh5huhlxsgzsjw/AxoPac.zip
-
Sample
250109-mz16hsxqat
Malware Config
Extracted
lumma
https://robinsharez.shop/api
https://handscreamny.shop/api
https://chipdonkeruz.shop/api
https://versersleep.shop/api
https://crowdwarek.shop/api
https://apporholis.shop/api
https://femalsabler.shop/api
https://soundtappysk.shop/api
https://letterdrive.shop/api
Targets
-
-
Target
https://download1527.mediafire.com/gvdsy9q4ly4gyWlzsR6kjz_C3Sn1ZLNzXtZNp7oTwtBCP5giLbnfSZaeNO1SDZwym_oJeoL9VMQ1m9X1AMmJ04c6pcwlYEAEenAAdvfeenwVV8zfXRVEgepGjZ40-5ZXZYNxXorO2ibTS5X1abHtUdS-_njuQqK2qsQVbScdgq0LSVc/0lh5huhlxsgzsjw/AxoPac.zip
Score10/10-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-