General

  • Target

    Test.ps1

  • Size

    2KB

  • Sample

    250126-xb1vysyrhw

  • MD5

    1bc29571638a14d15437d650c7f8b5d6

  • SHA1

    4a31f2ec99a7747af18cf7caa96950b80601da2b

  • SHA256

    1ee68dd6977f00a68a00b3331b728eeeffb1b0b0fc95c4a71594bef995f80bd0

  • SHA512

    a9ccfc4e7da5f4159b0056ee738bb95262b9fb74baeb7844efad31331a60a13a34ab4784712a8d59f11b5557e48eabd4872bb05e80139ec08510fabf76ba5eb2

Malware Config

Extracted

Family

lumma

C2

https://toppyneedus.biz/api

Targets

    • Target

      Test.ps1

    • Size

      2KB

    • MD5

      1bc29571638a14d15437d650c7f8b5d6

    • SHA1

      4a31f2ec99a7747af18cf7caa96950b80601da2b

    • SHA256

      1ee68dd6977f00a68a00b3331b728eeeffb1b0b0fc95c4a71594bef995f80bd0

    • SHA512

      a9ccfc4e7da5f4159b0056ee738bb95262b9fb74baeb7844efad31331a60a13a34ab4784712a8d59f11b5557e48eabd4872bb05e80139ec08510fabf76ba5eb2

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks