Overview

overview

10

Static

static

7

PhoenixC2-main.zip

windows10-2004-x64

10

PhoenixC2-main.zip

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PhoenixC2-main.zip

  • Size

    6.8MB

  • Sample

    250117-v8n7baymfp

  • MD5

    4eb6236503b5183b472da37e64cd1607

  • SHA1

    7c3fe88f5e3d62461e847c1cc6033bb157e20300

  • SHA256

    10fb0668623a29baa0c1e54448750fa18d3e3e6b5e8622f5d0dacde9513dcdb6

  • SHA512

    399cae4b1707841266d152336c6d85d9de6ed99eb3cddb09af747ecde6c7e47fc0d8e16d7cacaae10aaacb62650ab4ebaa82d1c8bdc464bfcfcfd843eae80004

  • SSDEEP

    196608:dq2Comx5bpXRCX2Xmb8jYYr3t/WabbfUogn+V2fA:QXNXRW2XOWvrd/WabDUoL0A

Score
10/10
lummaagilenetdiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Targets

    • Target

      PhoenixC2-main.zip

    • Size

      6.8MB

    • MD5

      4eb6236503b5183b472da37e64cd1607

    • SHA1

      7c3fe88f5e3d62461e847c1cc6033bb157e20300

    • SHA256

      10fb0668623a29baa0c1e54448750fa18d3e3e6b5e8622f5d0dacde9513dcdb6

    • SHA512

      399cae4b1707841266d152336c6d85d9de6ed99eb3cddb09af747ecde6c7e47fc0d8e16d7cacaae10aaacb62650ab4ebaa82d1c8bdc464bfcfcfd843eae80004

    • SSDEEP

      196608:dq2Comx5bpXRCX2Xmb8jYYr3t/WabbfUogn+V2fA:QXNXRW2XOWvrd/WabDUoL0A

    Score
    10/10
    lummadiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks