General

  • Target

    Set-up.exe

  • Size

    1.1MB

  • Sample

    250126-n41afs1jfz

  • MD5

    0d9501d1845ecc0172d0d0aff07ab6ce

  • SHA1

    ecb39c6db530afb68817717d65bce683208dcc80

  • SHA256

    405aa9de90e7eed532c8d80ba66cd199599743a8a2452f039acd78f113555a4a

  • SHA512

    f3c9bf6e48f0beacd6c02b130007aabea97a3f71f9f057bf67bd969eeb0623f274e08e365cd790993456f75ccb4cac005af4c5e330458ce50753fc0c25a2592c

  • SSDEEP

    24576:tOS2x2Z0kTRCzP+gCnkLt0y9k3mkcRCwVTKMPuz8JvWOKKH24C:sJMTRC7zCnYmy9k3oRCgTKPzeH2d

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://toppyneedus.biz/api

Targets

    • Target

      Set-up.exe

    • Size

      1.1MB

    • MD5

      0d9501d1845ecc0172d0d0aff07ab6ce

    • SHA1

      ecb39c6db530afb68817717d65bce683208dcc80

    • SHA256

      405aa9de90e7eed532c8d80ba66cd199599743a8a2452f039acd78f113555a4a

    • SHA512

      f3c9bf6e48f0beacd6c02b130007aabea97a3f71f9f057bf67bd969eeb0623f274e08e365cd790993456f75ccb4cac005af4c5e330458ce50753fc0c25a2592c

    • SSDEEP

      24576:tOS2x2Z0kTRCzP+gCnkLt0y9k3mkcRCwVTKMPuz8JvWOKKH24C:sJMTRC7zCnYmy9k3oRCgTKPzeH2d

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks