General
-
Target
CapCut crack Activator 2024.exe
-
Size
808.7MB
-
Sample
250302-q3zcwawny4
-
MD5
ed8a0f681c3af7dac3c57db1517e0c3b
-
SHA1
41d8615bdd9ecfc665c1063f89a65f7dde6bcd28
-
SHA256
518865bd78c66ddbe8bd26c847df27de42a663ac5f586f14ab1b544dfbff5b11
-
SHA512
7ee156228893f60ae492aa448cfe66d621373b10545c4ebc231a3dc23065804534392f7f7db7747a75cd2bec421a4007fa2fd2a3bc88872bee797075bf454d13
-
SSDEEP
393216:irOxtq4lv9TZuL3JEEfXy1o/gmLaUXfwuCPOql1:thliZEMC1oYmLwPO2
Static task
static1
Behavioral task
behavioral1
Sample
CapCut crack Activator 2024.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://childishbagge.fun/api
Targets
-
-
Target
CapCut crack Activator 2024.exe
-
Size
808.7MB
-
MD5
ed8a0f681c3af7dac3c57db1517e0c3b
-
SHA1
41d8615bdd9ecfc665c1063f89a65f7dde6bcd28
-
SHA256
518865bd78c66ddbe8bd26c847df27de42a663ac5f586f14ab1b544dfbff5b11
-
SHA512
7ee156228893f60ae492aa448cfe66d621373b10545c4ebc231a3dc23065804534392f7f7db7747a75cd2bec421a4007fa2fd2a3bc88872bee797075bf454d13
-
SSDEEP
393216:irOxtq4lv9TZuL3JEEfXy1o/gmLaUXfwuCPOql1:thliZEMC1oYmLwPO2
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3