General

  • Target

    SoftwareApp.exe

  • Size

    1.1MB

  • Sample

    250118-wsvjtszmfy

  • MD5

    79027a797eeeed90f0f914f229750eae

  • SHA1

    8e0576501a2a5b873754c6a7f0739bd79510164c

  • SHA256

    30338f9c85111cfde8e68398db0427f89a549427e0598384744f4a27d9d836d1

  • SHA512

    20d77e4c1dac67e5aeab3ec7c61bb5a5aecc10dd6f799ea99f9b8ac5ceb63b6a52d7f6d1089eb7c4c865cd081dc2ce4a2f886d56a159d1b8a41db9461b2c87e3

  • SSDEEP

    24576:ZXOMDyej0BM8I7oRCL7piz5nWXjeZW7nw5X319kSY07C7L:VPWe01RRGwn4jeZW7w13kSYZ

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://powerful-avoids.sbs/api

https://motion-treesz.sbs/api

https://disobey-curly.sbs/api

https://leg-sate-boat.sbs/api

https://story-tense-faz.sbs/api

https://blade-govern.sbs/api

https://occupy-blushi.sbs/api

https://frogs-severz.sbs/api

https://curved-goose.cyou/api

Targets

    • Target

      SoftwareApp.exe

    • Size

      1.1MB

    • MD5

      79027a797eeeed90f0f914f229750eae

    • SHA1

      8e0576501a2a5b873754c6a7f0739bd79510164c

    • SHA256

      30338f9c85111cfde8e68398db0427f89a549427e0598384744f4a27d9d836d1

    • SHA512

      20d77e4c1dac67e5aeab3ec7c61bb5a5aecc10dd6f799ea99f9b8ac5ceb63b6a52d7f6d1089eb7c4c865cd081dc2ce4a2f886d56a159d1b8a41db9461b2c87e3

    • SSDEEP

      24576:ZXOMDyej0BM8I7oRCL7piz5nWXjeZW7nw5X319kSY07C7L:VPWe01RRGwn4jeZW7w13kSYZ

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks