Overview

overview

10

Static

static

3

2025-01-14...uk.exe

windows7-x64

10

2025-01-14...uk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-14_aa75773cdc4c3541d40dc7d47d531094_cobalt-strike_ryuk

  • Size

    12.8MB

  • Sample

    250114-lzrreavna1

  • MD5

    aa75773cdc4c3541d40dc7d47d531094

  • SHA1

    7001339f95c43dcc42642c0e185a70b4214557c8

  • SHA256

    7c1668b3dd9994868e043ee4ee3b68abb97147a43057456da912419cd1f91175

  • SHA512

    66b96e72386567cec450d5717a70d7ac5cb5b8cec66da5b35726f6ada7477ee7ed40a39ed8a794b954ce8ad6f1d0dae6e9dfa67e9f5c5157c7752eeb31009494

  • SSDEEP

    196608:hL1kxR9F9KENR9N4bQOZNxVs0eb+CwRVu4fpbr7vOSPFjytXwt4TPnqunXcHF91v:uF3zv8Zrqb+CUuubX26jytnTPjnXcBv

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

Targets

    • Target

      2025-01-14_aa75773cdc4c3541d40dc7d47d531094_cobalt-strike_ryuk

    • Size

      12.8MB

    • MD5

      aa75773cdc4c3541d40dc7d47d531094

    • SHA1

      7001339f95c43dcc42642c0e185a70b4214557c8

    • SHA256

      7c1668b3dd9994868e043ee4ee3b68abb97147a43057456da912419cd1f91175

    • SHA512

      66b96e72386567cec450d5717a70d7ac5cb5b8cec66da5b35726f6ada7477ee7ed40a39ed8a794b954ce8ad6f1d0dae6e9dfa67e9f5c5157c7752eeb31009494

    • SSDEEP

      196608:hL1kxR9F9KENR9N4bQOZNxVs0eb+CwRVu4fpbr7vOSPFjytXwt4TPnqunXcHF91v:uF3zv8Zrqb+CUuubX26jytnTPjnXcBv

    Score
    10/10
    lummadiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks