General
-
Target
toto.txt
-
Size
499B
-
Sample
250111-rkwppstlfp
-
MD5
a54ada657efbbe1395598aae1bdac1f9
-
SHA1
a7887658eebba20bd97e43010ac5ffd5b972a273
-
SHA256
fa9cf901bd2c9359d2efc09f8adb1baa12ae56b841ba06dd057cefd58c778316
-
SHA512
f78a115a61450bd156959371572730c7c6a262907ae6dfc33fbafe77660cc5c5db0e9ca2795750f069efdce8d5f0f033d61aed50097fe89e94d59e3c89e1184b
Static task
static1
Behavioral task
behavioral1
Sample
toto.ps1
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://human-cldf.com/gamdos.zip
Extracted
lumma
https://shitwavvez.cyou/api
Targets
-
-
Target
toto.txt
-
Size
499B
-
MD5
a54ada657efbbe1395598aae1bdac1f9
-
SHA1
a7887658eebba20bd97e43010ac5ffd5b972a273
-
SHA256
fa9cf901bd2c9359d2efc09f8adb1baa12ae56b841ba06dd057cefd58c778316
-
SHA512
f78a115a61450bd156959371572730c7c6a262907ae6dfc33fbafe77660cc5c5db0e9ca2795750f069efdce8d5f0f033d61aed50097fe89e94d59e3c89e1184b
-
Lumma family
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-