General
-
Target
db79ddeedbc4382417fca8b7d8667c2b.bin
-
Size
184KB
-
MD5
25043acbacdcbc300ecb5434f2aaef28
-
SHA1
9cba75a7231b102096a43c702885e21414ca35ba
-
SHA256
23e8e98aabdbd28d477f864f60f7d2e913346740066c1a508547e3ed286de16d
-
SHA512
8d98d42afb44967f7fc4ab2f4c1f454e144510ae4b961b06c6096a2a25e4629f9684aa4e8f94dc96e44bef61be9bc1e0bb249c88d51fa3dbdb3c47b0245a27aa
-
SSDEEP
3072:TPA6RnpZ4jhD/rSpyRd+KyPlp8HQgesrgdAJQgbOzNSxEEnXr7QuUAduN1fyhzDH:TIXvOHeHQzdpTJSX/QujduPCzDh6g
Score
10/10
Malware Config
Extracted
Family
lumma
C2
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
db79ddeedbc4382417fca8b7d8667c2b.bin
Password: infected
-
2acdb7c078028606979809be5d20a81ab18d3ffc4f954422c8e229cfc67eaf14.exe
Password: infected
Headers
Sections