General

  • Target

    Newl Upd [v2.1.0].exe

  • Size

    150.0MB

  • Sample

    250113-2ar9msyrav

  • MD5

    369783d982d4a7e8decbff08e563de53

  • SHA1

    008c5a5a205097ede95634d700299534ec7d22ec

  • SHA256

    09b44778b0010e8b8e5e520b4143d76ce71e46ccd74ccef70bab5dada191a4a0

  • SHA512

    6fab20d2fd9b453d8ea3518d00fa8270be00e549efdd1db90fcf978b97df475cc6b97f55dfd05ce5c14cf09095ea1da55331ecf27b0df2253d9d15a1a0d3dde3

  • SSDEEP

    24576:fGkqth6KdOsff8VS1IxCl8Qr0FWviIGLVR/4hmCt:3odVf8VS1IxCKQrztGr/Kmo

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://feerdaiks.biz/api

Targets

    • Target

      Newl Upd [v2.1.0].exe

    • Size

      150.0MB

    • MD5

      369783d982d4a7e8decbff08e563de53

    • SHA1

      008c5a5a205097ede95634d700299534ec7d22ec

    • SHA256

      09b44778b0010e8b8e5e520b4143d76ce71e46ccd74ccef70bab5dada191a4a0

    • SHA512

      6fab20d2fd9b453d8ea3518d00fa8270be00e549efdd1db90fcf978b97df475cc6b97f55dfd05ce5c14cf09095ea1da55331ecf27b0df2253d9d15a1a0d3dde3

    • SSDEEP

      24576:fGkqth6KdOsff8VS1IxCl8Qr0FWviIGLVR/4hmCt:3odVf8VS1IxCKQrztGr/Kmo

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks