General

  • Target

    𝐿@π“‰π‘’π“ˆπ“‰_𝐹!πΏπΈβœ¨π’Ÿπ‘œπ“Œπ“ƒπ“π‘œπ’Άd-πΉπ“Šπ“πΏ-π’žπ‘œπ“‚π“…π“π‘’π“‰π‘’_2025 (2025).zip

  • Size

    48.2MB

  • Sample

    250113-fq9mzazlgp

  • MD5

    c053964c199592f3500343d0e8fa2102

  • SHA1

    1dd45fa882c3920f42acec218658b5aa3c3f93a8

  • SHA256

    e41c4d4e8074093d644d7fbb46d65ca3564797655417b6a1f905eba3ad61aee6

  • SHA512

    6f9bf395ceaaf3faa62305b125990b61b57cacf601debb4bd79c093c6d88d6fc50967d537ee44b3ca26410394fa8584e90e3de1bef4d8978b17dc5c73e6a6d25

  • SSDEEP

    1572864:nYGFHktvV1w+hw0tEFHpOgKPUpx3A9ClocS:nYGFAVHhw0e/KgQYKcS

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://joinmilkeu.shop/api

https://burnwastefulke.shop/api

Targets

    • Target

      𝐿@π“‰π‘’π“ˆπ“‰~𝐹!πΏπΈβœ¨π’Ÿπ‘œπ“Œπ“ƒπ“π‘œπ’Άd-πΉπ“Šπ“πΏ-π’žπ‘œπ“‚π“…π“π‘’π“‰π‘’_2025/𝐿@π“‰π‘’π“ˆπ“‰~𝐹!𝐿𝐸-πΉπ“Šπ“πΏ-π’žπ‘œπ“‚π“…π“π‘’π“‰π‘’2025.7z

    • Size

      46.4MB

    • MD5

      831728a695303fec51d1ac1a2dd167e7

    • SHA1

      efb651b8c50d45a40bbf5bdf7f26e0f1c0d9f45e

    • SHA256

      22886e5225e570bc56e82d2408bfd00f0aba37f4d63a3de0da807e62daa672d6

    • SHA512

      56eaa1a909457c187475265bb6ac117a94b07d2dc44f8c9049b0557feebce4fd1abf5e157587364267b7f4acfed76e9925b54185bed707839e1f020288a947d7

    • SSDEEP

      786432:M0UHk6IvVZCOWlkwhFUu81OP6TM0tEFHpStkOgKPUPRxy5+A9CBEkToccf:MFHktvV1w+hw0tEFHpOgKPUpx3A9Cloh

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks