General

  • Target

    script.ps1

  • Size

    2KB

  • Sample

    250122-1lyecsxlgz

  • MD5

    693de5c0e94d35e8353960bcac6ede81

  • SHA1

    37b35dfe458c8de86bde29daf4a3347d9b44f73e

  • SHA256

    c7b72d815d7f0cb35a77b0dc49181376e84f5d849223f761d55a034009d661fa

  • SHA512

    141cbfe5bb35cc66fc8aced0a62247952d8814566c24937bd1bb3708f9e35fb7ac1f0733461f09d67e2562fe3e90bc2516e0efcc09401f48796f903a4a083580

Malware Config

Extracted

Family

lumma

C2

https://impolitewearr.biz/api

https://toppyneedus.biz/api

https://lightdeerysua.biz/api

https://suggestyuoz.biz/api

https://hoursuhouy.biz/api

https://mixedrecipew.biz/api

https://affordtempyo.biz/api

https://pleasedcfrown.biz/api

Targets

    • Target

      script.ps1

    • Size

      2KB

    • MD5

      693de5c0e94d35e8353960bcac6ede81

    • SHA1

      37b35dfe458c8de86bde29daf4a3347d9b44f73e

    • SHA256

      c7b72d815d7f0cb35a77b0dc49181376e84f5d849223f761d55a034009d661fa

    • SHA512

      141cbfe5bb35cc66fc8aced0a62247952d8814566c24937bd1bb3708f9e35fb7ac1f0733461f09d67e2562fe3e90bc2516e0efcc09401f48796f903a4a083580

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks