General

  • Target

    Swift_Installer.exe

  • Size

    1.1MB

  • Sample

    250118-w5zz3szqfs

  • MD5

    a5990881f6f810fd37440a5b57f107a4

  • SHA1

    e04d23e20cedff2f97b0eeb497a83c51fee82846

  • SHA256

    49e5362bcfa679680698868be9ce46eeb17bcebc0f0f7ba41c67dfafaada93cd

  • SHA512

    b7e211f2218133bbf94080feb298d67982610da69dd9b29d28eeeee1d9c26a379c1e6bafa72914556b1e8278e9fb16e8b92ca4a5195fbd9c8983e6d44a0a0983

  • SSDEEP

    24576:fD0XJKMonRrNLZj2SgiypV1/+cnNaBl2URlGnKJQXdSE3w3:rIBuRrZV2S6pV1gDNRj7E3w3

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://tinpanckakgou.shop/api

Targets

    • Target

      Swift_Installer.exe

    • Size

      1.1MB

    • MD5

      a5990881f6f810fd37440a5b57f107a4

    • SHA1

      e04d23e20cedff2f97b0eeb497a83c51fee82846

    • SHA256

      49e5362bcfa679680698868be9ce46eeb17bcebc0f0f7ba41c67dfafaada93cd

    • SHA512

      b7e211f2218133bbf94080feb298d67982610da69dd9b29d28eeeee1d9c26a379c1e6bafa72914556b1e8278e9fb16e8b92ca4a5195fbd9c8983e6d44a0a0983

    • SSDEEP

      24576:fD0XJKMonRrNLZj2SgiypV1/+cnNaBl2URlGnKJQXdSE3w3:rIBuRrZV2S6pV1gDNRj7E3w3

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks