Overview

overview

10

Static

static

3

fea83020f2...bd.exe

windows7-x64

3

fea83020f2...bd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fea83020f2e2f4bda1633a5b3ee8a2bb25bf718a7e95064ee70e55fe9c2117bd.zip

  • Size

    1.2MB

  • Sample

    250110-3wxa6atmfx

  • MD5

    1f0fc281c81367fbfab615c2efe69188

  • SHA1

    4c234b6a4bab5e4ada8aed94c2d42cb526916d6e

  • SHA256

    fea83020f2e2f4bda1633a5b3ee8a2bb25bf718a7e95064ee70e55fe9c2117bd

  • SHA512

    bb0d4db3350bb3a5c23689b38f1daa1b284ae4000ae08062ac2ad287c6643e50549da15ae20fc0c68a49981f3f6f582f88a64b0b8771382105dbb34c8e3d730e

  • SSDEEP

    24576:BA9mxewo34tmN8C1pLEmIJdRxiXTDAvQKtatP+kFlxjpy8f:69oewoUW1VEmIkDDAI6kFxdf

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://beliefbidu.cyou/api

https://fraggielek.biz/api

https://grandiouseziu.biz/api

https://littlenotii.biz/api

https://marketlumpe.biz/api

https://nuttyshopr.biz/api

https://punishzement.biz/api

https://spookycappy.biz/api

https://truculengisau.biz/api

Targets

    • Target

      fea83020f2e2f4bda1633a5b3ee8a2bb25bf718a7e95064ee70e55fe9c2117bd.zip

    • Size

      1.2MB

    • MD5

      1f0fc281c81367fbfab615c2efe69188

    • SHA1

      4c234b6a4bab5e4ada8aed94c2d42cb526916d6e

    • SHA256

      fea83020f2e2f4bda1633a5b3ee8a2bb25bf718a7e95064ee70e55fe9c2117bd

    • SHA512

      bb0d4db3350bb3a5c23689b38f1daa1b284ae4000ae08062ac2ad287c6643e50549da15ae20fc0c68a49981f3f6f582f88a64b0b8771382105dbb34c8e3d730e

    • SSDEEP

      24576:BA9mxewo34tmN8C1pLEmIJdRxiXTDAvQKtatP+kFlxjpy8f:69oewoUW1VEmIkDDAI6kFxdf

    Score
    10/10
    discoverylummastealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks