Overview
overview
10Static
static
3QtCore4.dll
windows7-x64
3QtCore4.dll
windows10-2004-x64
3QtGui4.dll
windows7-x64
3QtGui4.dll
windows10-2004-x64
3QtNetwork4.dll
windows7-x64
3QtNetwork4.dll
windows10-2004-x64
3QtWebKit4.dll
windows7-x64
3QtWebKit4.dll
windows10-2004-x64
3ReFB.exe
windows7-x64
10ReFB.exe
windows10-2004-x64
10msvcp100.dll
windows7-x64
3msvcp100.dll
windows10-2004-x64
3msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3General
-
Target
342234234.zip
-
Size
11.2MB
-
Sample
250113-eg2ekavjhy
-
MD5
6fc5ad30d84cbc75b0c3e4b1fb03d99a
-
SHA1
32e62b74267c167d550c5bcf0ae8ba8f2b46ed85
-
SHA256
6aa911d2f11777555fe26594220bb419cbed102620e9ac5c3f2c57e8a7bfdf1c
-
SHA512
9f0b6538e19de6c8493927e6ae04eb25bb8a8005a8c045274824edd0d9ed6ed05733c2f9502d9bc9fa0dddbc0fdd8f054e77e66dad6d0c93cf31b454482a94af
-
SSDEEP
196608:JX5dKqA3xEUBhuUKxD2iDLZMQOcA1u9HV3xYDCDZsZ3HHHolKvHBX1Drn0JhlB+:JX5dBkxE0huU7iDapcB3xYG0XIuXNrnv
Static task
static1
Behavioral task
behavioral1
Sample
QtCore4.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
QtCore4.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
QtGui4.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
QtGui4.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
QtNetwork4.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
QtNetwork4.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
QtWebKit4.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
QtWebKit4.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ReFB.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
ReFB.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
msvcp100.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
msvcp100.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
msvcr100.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
msvcr100.dll
Resource
win10v2004-20241007-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Targets
-
-
Target
QtCore4.dll
-
Size
2.5MB
-
MD5
fecc62a37d37d9759e6b02041728aa23
-
SHA1
0c5f646caef7a6e9073d58ed698f6cfbfb2883a3
-
SHA256
94c1395153d7758900979351e633ab68d22ae9b306ef8e253b712a1aab54c805
-
SHA512
698f90f1248dacbd4bdc49045a4e80972783d9dcec120d187abd08f5ef03224b511f7870320938b7e8be049c243ffb1c450c847429434ef2e2c09288cb9286a6
-
SSDEEP
49152:VTFgiFpGXOENKSgjGkJsv6tWKFdu9C6TELyvL/6mShMZtmjNUVrciV5P+7QVg07/:V+iDaWjxJsv6tWKFdu9CZgfQ
Score3/10 -
-
-
Target
QtGui4.dll
-
Size
8.2MB
-
MD5
831ba3a8c9d9916bdf82e07a3e8338cc
-
SHA1
6c89fd258937427d14d5042736fdfccd0049f042
-
SHA256
d2c8c8b6cc783e4c00a5ef3365457d776dfc1205a346b676915e39d434f5a52d
-
SHA512
beda57851e0e3781ece1d0ee53a3f86c52ba99cb045943227b6c8fc1848a452269f2768bf4c661e27ddfbe436df82cfd1de54706d814f81797a13fefec4602c5
-
SSDEEP
98304:YxRJATZlLne1/cF6ZWHxD1HFH+J+70msIWeiLtRgi3d4PJpTcSqxyr:YxiZBG2xpljTcJy
Score3/10 -
-
-
Target
QtNetwork4.dll
-
Size
1.0MB
-
MD5
8a2e025fd3ddd56c8e4f63416e46e2ec
-
SHA1
5f58feb11e84aa41d5548f5a30fc758221e9dd64
-
SHA256
52ae07d1d6a467283055a3512d655b6a43a42767024e57279784701206d97003
-
SHA512
8e3a449163e775dc000e9674bca81ffabc7fecd9278da5a40659620cfc9cc07f50cc29341e74176fe10717b2a12ea3d5148d1ffc906bc809b1cd5c8c59de7ba1
-
SSDEEP
12288:m+PpRNPe4+DZFvnwJ9o+Hllp59K03AskvvukLosiLHrv7F0YmIYunuGS:m+hRCZhwY+Hllp59OHvfo7HrCYmItnC
Score3/10 -
-
-
Target
QtWebKit4.dll
-
Size
12.5MB
-
MD5
df68febc876575329e93938eba19848f
-
SHA1
a96949f2782e70911f33937043ac54e6fe48ca24
-
SHA256
3127cbbf3afaeb191ca918175ad4c6bfbdd68f8ce38ffa06206ba543576e84e2
-
SHA512
f0f6dc90dd640a1f90de77e3c99c8306446bfd79d0c4b4f7119e421efd26137a9fb6607de8a229ed4dd8686fd84a2f042334a7e836db1eeab69f33f232fa3385
-
SSDEEP
98304:YfyKJXPSGJ9opKMT/HSWmgskU9Kbrh0oHCXRm6fch5dEDlxnZTZQFlNNN7wIcQ0U:YKmcpZ3sE/+oHCX828+JxnmtcQ0
Score3/10 -
-
-
Target
ReFB.exe
-
Size
80KB
-
MD5
2a8613b7d99903516b8fe02fd820bf52
-
SHA1
78a96addcb556ab1d490fac80f929305263d06b9
-
SHA256
f1d68c5e7c7660d4f2ce412c109b7fe3e088872fa0ebe61ca9ab9dd92a496407
-
SHA512
af0902aeb6169ea507b787da7b61c3533df4610c3f51c1d8f65dfc9008c8ce2580f2d86a49a4d0acc2c51c731f3e4c447d0d1d8e779dc1c75e43d30b79c46436
-
SSDEEP
1536:9A8oAY5SXfidLez+Q+EGfdUHLLXJ+CqoVpPBucQwk7qnKXKo5OMY8xk03ben8TK:M7Ohz+Q+EGlUHLLXJ+CqoTPBucQwktXS
-
Lumma family
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
-
-
Target
msvcp100.dll
-
Size
411KB
-
MD5
03e9314004f504a14a61c3d364b62f66
-
SHA1
0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d
-
SHA256
a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f
-
SHA512
2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d
-
SSDEEP
12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8
Score3/10 -
-
-
Target
msvcr100.dll
-
Size
752KB
-
MD5
67ec459e42d3081dd8fd34356f7cafc1
-
SHA1
1738050616169d5b17b5adac3ff0370b8c642734
-
SHA256
1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
-
SHA512
9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
-
SSDEEP
12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
Score3/10 -