General
-
Target
script.ps1
-
Size
2KB
-
Sample
250122-1lyecsxlgz
-
MD5
693de5c0e94d35e8353960bcac6ede81
-
SHA1
37b35dfe458c8de86bde29daf4a3347d9b44f73e
-
SHA256
c7b72d815d7f0cb35a77b0dc49181376e84f5d849223f761d55a034009d661fa
-
SHA512
141cbfe5bb35cc66fc8aced0a62247952d8814566c24937bd1bb3708f9e35fb7ac1f0733461f09d67e2562fe3e90bc2516e0efcc09401f48796f903a4a083580
Static task
static1
Behavioral task
behavioral1
Sample
script.ps1
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://impolitewearr.biz/api
https://toppyneedus.biz/api
https://lightdeerysua.biz/api
https://suggestyuoz.biz/api
https://hoursuhouy.biz/api
https://mixedrecipew.biz/api
https://affordtempyo.biz/api
https://pleasedcfrown.biz/api
Targets
-
-
Target
script.ps1
-
Size
2KB
-
MD5
693de5c0e94d35e8353960bcac6ede81
-
SHA1
37b35dfe458c8de86bde29daf4a3347d9b44f73e
-
SHA256
c7b72d815d7f0cb35a77b0dc49181376e84f5d849223f761d55a034009d661fa
-
SHA512
141cbfe5bb35cc66fc8aced0a62247952d8814566c24937bd1bb3708f9e35fb7ac1f0733461f09d67e2562fe3e90bc2516e0efcc09401f48796f903a4a083580
-
Lumma family
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-