General

  • Target

    Nihon.zip

  • Size

    569KB

  • Sample

    250129-2d4rva1mhz

  • MD5

    d9fa3c32e43c0ef601fe32da6ad55488

  • SHA1

    e6d696907d2e3e315a33abbc3843cc7387356d3a

  • SHA256

    9b352b16f906a58474783588d65529d1336d7a19facc5ac56884c0d299db7cc9

  • SHA512

    a55be6c8f261a3f4a18d2f8879f4a48e1f65f79705784e49c8b594b1139b19fc02d3b5932919562fae63f5f4a075a5f87f3929ead8a1a3257540ba52e6e3a93d

  • SSDEEP

    12288:hnqZkEb6EcwNbyRbA+MDxqSLLEPcOiQavOsi:x4byRbVSLLPOgOsi

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://toppyneedus.biz/api

Targets

    • Target

      Nihon.exe

    • Size

      533KB

    • MD5

      91d611c84f4b8aa6478e94460817fb37

    • SHA1

      c1b758e840ccdf6b10a19e1bdbcfe284913670ba

    • SHA256

      a81afd5fe711453f87ae10559bc3b716b17e5971e31749d3274369dd5868c291

    • SHA512

      7963358bef8fa8db93d52ef107d941e068013c60b2ed275caa875549f9aa2608f2ffdb230eb872a398fbecfe6143af9ee5fb4a2bf703a4e713ad01902258807b

    • SSDEEP

      12288:KZkEb6EcwNbyRbA+MDxqSLLEPcOiQavOs0:YbyRbVSLLPOgOs0

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Suspicious use of SetThreadContext

    • Target

      client.dll

    • Size

      36KB

    • MD5

      702348a3919a13f056ab52a8085c5b5b

    • SHA1

      983d64793741ed973ddafdd9a9575758a25903e2

    • SHA256

      8c5f289d8817f1ff725dcca44b93a0a9bebdbb933750ebe81e91c33c561c875c

    • SHA512

      77de57951a962db3185666b43f3a8f7237b21f395d47586bc94f8adbe7f9b4ca3e1c79fe78f82b5f989d381359a83931122a3c95b0e0a9e8bf13bcfa8ea1eba6

    • SSDEEP

      384:Ghqvps9SA75hm9PLjkGwkCt0PFSExtZYN0GgZqsPm2AXV6Eb8R7D:Gsvp4ShPsGwRR0GgZ3kXV6Eb8R7D

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks