General
-
Target
Newl Upd [v2.1.0].exe
-
Size
150.0MB
-
Sample
250113-2ar9msyrav
-
MD5
369783d982d4a7e8decbff08e563de53
-
SHA1
008c5a5a205097ede95634d700299534ec7d22ec
-
SHA256
09b44778b0010e8b8e5e520b4143d76ce71e46ccd74ccef70bab5dada191a4a0
-
SHA512
6fab20d2fd9b453d8ea3518d00fa8270be00e549efdd1db90fcf978b97df475cc6b97f55dfd05ce5c14cf09095ea1da55331ecf27b0df2253d9d15a1a0d3dde3
-
SSDEEP
24576:fGkqth6KdOsff8VS1IxCl8Qr0FWviIGLVR/4hmCt:3odVf8VS1IxCKQrztGr/Kmo
Static task
static1
Malware Config
Extracted
lumma
https://feerdaiks.biz/api
Targets
-
-
Target
Newl Upd [v2.1.0].exe
-
Size
150.0MB
-
MD5
369783d982d4a7e8decbff08e563de53
-
SHA1
008c5a5a205097ede95634d700299534ec7d22ec
-
SHA256
09b44778b0010e8b8e5e520b4143d76ce71e46ccd74ccef70bab5dada191a4a0
-
SHA512
6fab20d2fd9b453d8ea3518d00fa8270be00e549efdd1db90fcf978b97df475cc6b97f55dfd05ce5c14cf09095ea1da55331ecf27b0df2253d9d15a1a0d3dde3
-
SSDEEP
24576:fGkqth6KdOsff8VS1IxCl8Qr0FWviIGLVR/4hmCt:3odVf8VS1IxCKQrztGr/Kmo
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates processes with tasklist
-