Resubmissions

16-01-2025 22:34

250116-2hhp6ssrgj 10

16-01-2025 22:29

250116-2emjyssqfn 3

General

  • Target

    https://dirol-netrol.com/poimi/toto.txt

  • Sample

    250116-2hhp6ssrgj

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://dirol-netrol.com/poimi/toto.txt

Extracted

Family

lumma

C2

https://foreigoiru.cyou/api

Targets

    • Target

      https://dirol-netrol.com/poimi/toto.txt

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks