Resubmissions

13-02-2025 00:07

250213-aetjqazndp 10

13-02-2025 00:06

250213-adthbs1jbt 10

13-02-2025 00:02

250213-abyn9szrhw 10

General

  • Target

    π˜Ύπ™€π™’π™₯π™‘π™šπ™©π™šπŸ“€π˜Ώπ™€π™¬π™£π™‘π™€π™–π™™+π™Žπ™šπ™©π™ͺπ™₯_(𝟸𝟢𝟸𝟻).zip

  • Size

    44.6MB

  • Sample

    250213-aetjqazndp

  • MD5

    eae56879fdf409a70b0bf4e0730e99d9

  • SHA1

    9da60aaed3bb7b2150dae7be1fe954ff3d79d6cf

  • SHA256

    901884e985e590851ff222852431adae8373029c703ef7587186fd961ad83be6

  • SHA512

    5577f298f601820e6bd91874c5fd00d810507c261dd03498b9db352cbfdcc842190e4e3ddcaef1798150a7ecced6a24a1be47a3ef8700e8606e50ad0738828fb

  • SSDEEP

    786432:A/lDESg/aC+n09Tzef95bXRqE9qz2ABF4wD6VpFbTrKrOz1N:KmS2SQzgQ6tfOyL

Malware Config

Extracted

Family

lumma

C2

https://clxearnest.cyou/api

Targets

    • Target

      π™„π™‰π™Žπ™π˜Όπ™‡π™‡πŸ’Ύπ™π™π™€π™€+π™‹π˜Ύ_π™Žπ™€π™π™π™‹_(𝟸𝟢𝟸𝟻).7z

    • Size

      44.4MB

    • MD5

      7da0277ee99475887edbb62a43a760ca

    • SHA1

      4ebd6df5620a6c8d92f695af85df7c0623c21aeb

    • SHA256

      d4c2d2ff11563416c5eb7a456af7ff1b7ac9d8ae6bcb668e969b9027c4844c41

    • SHA512

      fce720c5d51d962599e1976fe920a48289ca7ad5c982d8b7a5bff1e98ba3bd50d383ebc18bd4ca3e0c9039ffc8b4d27ed1fe4d5caa6788f542b45db14e47ae83

    • SSDEEP

      786432:S/lDESg/aC+n09Tzef95bXRqE9qz2ABF4wD6VpFbTrKrOz1w:4mS2SQzgQ6tfOy6

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks