General

  • Target

    πŸŒ€πΉπ“Šπ“πΏ~𝐹𝒾ℒ𝑒-π·π‘œπ“Œπ“ƒπ“π‘œπ’Άπ’Ήβœ¨πΉπ“Šπ“πΏ-π’π‘’π“‰π“Šπ“…~2025.zip

  • Size

    46.5MB

  • Sample

    250114-wvax7sxlfk

  • MD5

    99d632e17db4d04d57f7cd9f2fced788

  • SHA1

    d9a95b9d272db26308ed4921632a74eff524f0c3

  • SHA256

    ff51141c3eb899225e341327e9d717a37ec4af824335d9bd83e874616c24ada6

  • SHA512

    b2b347d2a4d9e76b2621c0781b1ceaa6d931c45413d3101ecfacb46e339ab2887f0535e927a1afac9fca84e626140920d3ae48141e9365799e00ad83b7df32e5

  • SSDEEP

    786432:CccTEDpK5HoMxn6AkyzkoVgdnMSQgqgwDeB3iYxsFifgcFrq4BtLsLCr20T:CWA5Rxn6Aky9nhDelXeFUF5BtLGCrXT

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://drainytwiggy.shop/api

Targets

    • Target

      πŸŒ€πΉπ“Šπ“πΏ~𝐹𝒾ℒ𝑒-π·π‘œπ“Œπ“ƒπ“π‘œπ’Άπ’Ήβœ¨πΉπ“Šπ“πΏ-π’π‘’π“‰π“Šπ“…~2025/π–Žπ–“π–˜π–™π–†π–‘π–‘β˜°π–‘π–†π–™π–Šπ–˜π–™β§—π–œπ–Žπ–“π–‰π–”π–œπ–˜~π–˜π–Šπ–™π–šπ–•β€³2025.7z

    • Size

      46.3MB

    • MD5

      8a0ce588302c5ed3ff83210698e17402

    • SHA1

      e5e34f4c891e81546f332e1b7d652f97eafb2beb

    • SHA256

      7d945fce68cd92bf8f7af513b3b050ce70995624c27a479e381531ff5570ba90

    • SHA512

      3c8dadd6dcfb670d43c8779ee3d8cbfae0734912e06a9c6f059afccb0aab8f054dd22a1780b18ac88ddea134eb962bc3380e9d7a00e7ea4f864edbed3d881b22

    • SSDEEP

      786432:CcTEDpK5HoMxn6AkyzkoVgdnMSQgqgwDeB3iYxsFifgcFrq4BtLsLCr20z:wA5Rxn6Aky9nhDelXeFUF5BtLGCrXz

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks