General

  • Target

    ✦Pα†¢н⚘𝓜ø𝔡℮яи💡𝐒єrℓℓ🔮𝐂𝓸𝑑𝑒✤𝐒єт𝓤ρ𝐌υℓтιTℓε=9192.7z

  • Size

    31.8MB

  • Sample

    250301-pzskgssjs7

  • MD5

    33a74c0525e96223f7a7fe6fa7357578

  • SHA1

    1457ea777dc80dcea2769bd5f1d940f2406cfe7a

  • SHA256

    c2d082e3a6c835753b20a7f539b417f44585fca64ec6d7ee473ddb4cee2c2d07

  • SHA512

    b30e72b18a611f7b324950e6010e63f4d00e02c30ea8ec3f0beb68eb1d7539df2bddcd6a37fcf63c65b7f3b992939092853a5da0b8c8a702fc614a10f17fa9f1

  • SSDEEP

    393216:enKdQKVrk8pPYjHsf6kFEe4XCZLdFfJqCI5nOfGAbS4F0UQiPMwDce18IeVH8OMP:enZKGjMyBe4yx+Of9VFbPIe0dtllRpTs

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://powerful-avoids.sbs/api

https://motion-treesz.sbs/api

https://disobey-curly.sbs/api

https://leg-sate-boat.sbs/api

https://story-tense-faz.sbs/api

https://blade-govern.sbs/api

https://occupy-blushi.sbs/api

https://frogs-severz.sbs/api

https://other-rans.cyou/api

Targets

    • Target

      ✦Pα†¢н⚘𝓜ø𝔡℮яи💡𝐒єrℓℓ🔮𝐂𝓸𝑑𝑒✤𝐒єт𝓤ρ𝐌υℓтιTℓε=9192/Set-up.exe

    • Size

      1.8MB

    • MD5

      098ac4621ee0e855e0710710736c2955

    • SHA1

      ce7b88657c3449d5d05591314aaa43bd3e32bdaa

    • SHA256

      46afbf1cbd2e1b5e108c133d4079faddc7347231b0c48566fd967a3070745e7f

    • SHA512

      3042785b81bd18b641f0a2b5d8aec8ef86f9bf1269421fb96d1db35a913e744eaff16d9da7a02c8001435d59befb9f26bc0bbfa6e794811abf4282ed68b185fe

    • SSDEEP

      49152:GpjwrP6yVgBd39sUUzFti4aTotmIT3SxLmNKbx:GpjwrP6yKTOUmi4aTo1NK9

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks