General
-
Target
πΎπ€π’π₯π‘ππ©πππΏπ€π¬π£π‘π€ππ+πππ©πͺπ₯_(πΈπΆπΈπ»).zip
-
Size
44.6MB
-
Sample
250213-aetjqazndp
-
MD5
eae56879fdf409a70b0bf4e0730e99d9
-
SHA1
9da60aaed3bb7b2150dae7be1fe954ff3d79d6cf
-
SHA256
901884e985e590851ff222852431adae8373029c703ef7587186fd961ad83be6
-
SHA512
5577f298f601820e6bd91874c5fd00d810507c261dd03498b9db352cbfdcc842190e4e3ddcaef1798150a7ecced6a24a1be47a3ef8700e8606e50ad0738828fb
-
SSDEEP
786432:A/lDESg/aC+n09Tzef95bXRqE9qz2ABF4wD6VpFbTrKrOz1N:KmS2SQzgQ6tfOyL
Malware Config
Extracted
lumma
https://clxearnest.cyou/api
Targets
-
-
Target
πππππΌπππΎππππ+ππΎ_πππππ_(πΈπΆπΈπ»).7z
-
Size
44.4MB
-
MD5
7da0277ee99475887edbb62a43a760ca
-
SHA1
4ebd6df5620a6c8d92f695af85df7c0623c21aeb
-
SHA256
d4c2d2ff11563416c5eb7a456af7ff1b7ac9d8ae6bcb668e969b9027c4844c41
-
SHA512
fce720c5d51d962599e1976fe920a48289ca7ad5c982d8b7a5bff1e98ba3bd50d383ebc18bd4ca3e0c9039ffc8b4d27ed1fe4d5caa6788f542b45db14e47ae83
-
SSDEEP
786432:S/lDESg/aC+n09Tzef95bXRqE9qz2ABF4wD6VpFbTrKrOz1w:4mS2SQzgQ6tfOy6
-
Lumma family
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3