General

  • Target

    Loader.exe

  • Size

    1.1MB

  • Sample

    250111-agr4nsxjbr

  • MD5

    16ac36a918c29f1e3f54ada06befdca9

  • SHA1

    69f59cfe33b74fe22864e269d9bb60d932c79001

  • SHA256

    5a7a88b315c2a2dc81ac4b5af5f48b310a13ffd7377a9608bec5d72717d99343

  • SHA512

    349f0853d4cf052767139ee74d00892e31db661766008478c2f65bf24f008b51b88736520fda6c2f73069c89bcdd630ebbef6600e76ce4c9a8b7624445519549

  • SSDEEP

    24576:pAodEpXENNq0lH68t/eNil3VHmFgugQWkh2otY/Ocw9zq3mHZb7Tb7j:qHD048gklHcMQWkh2o8ObVq3id

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://robinsharez.shop/api

https://handscreamny.shop/api

https://chipdonkeruz.shop/api

https://versersleep.shop/api

https://crowdwarek.shop/api

https://apporholis.shop/api

https://femalsabler.shop/api

https://soundtappysk.shop/api

https://sailstrangej.cyou/api

Extracted

Family

lumma

C2

https://sailstrangej.cyou/api

Targets

    • Target

      Loader.exe

    • Size

      1.1MB

    • MD5

      16ac36a918c29f1e3f54ada06befdca9

    • SHA1

      69f59cfe33b74fe22864e269d9bb60d932c79001

    • SHA256

      5a7a88b315c2a2dc81ac4b5af5f48b310a13ffd7377a9608bec5d72717d99343

    • SHA512

      349f0853d4cf052767139ee74d00892e31db661766008478c2f65bf24f008b51b88736520fda6c2f73069c89bcdd630ebbef6600e76ce4c9a8b7624445519549

    • SSDEEP

      24576:pAodEpXENNq0lH68t/eNil3VHmFgugQWkh2otY/Ocw9zq3mHZb7Tb7j:qHD048gklHcMQWkh2o8ObVq3id

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks