Overview

overview

10

Static

static

4

♦•Rèa...•.7z

windows7-x64

1

♦•Rèa...•.7z

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ♦•Rèady•Fîlè•PassW0rd•Is•♦11148•.zip

  • Size

    8.0MB

  • Sample

    250314-kszm1axvet

  • MD5

    00dfc4eb1a07e08780f50410e68241fa

  • SHA1

    4ae6f77eaf78ec794a239223c9fbd987b9fc833e

  • SHA256

    4a5ad2ac55adc278ff825ea46d4f89065084f6735c96d1ed30e183d2caca9ed7

  • SHA512

    38c78c0e46e0ac0107502277c9bcb6f6755b8443e974208b996bf3a253bc9aad4f8dc971e45931f319fdccd5a4fe506a782b40d09bee4cce020caf8f238ff936

  • SSDEEP

    196608:lr3VkNhAwfYGVfk/toNrjLtTpQhCv5VkAd7jyZvW0eW50YnYW:lZkYvGVfmarj5Tb8mjyZvPN51p

Score
10/10
latrodectuslummadiscoverylinkloaderpdfspywarestealer

Malware Config

Extracted

Family

lumma

C2

https://hingehjan.shop/api

https://featureccus.shop/api

https://wmrodularmall.top/api

https://jowinjoinery.icu/api

https://legenassedk.top/api

https://htardwarehu.icu/api

https://2cjlaspcorne.icu/api

https://bugildbett.top/api

https://6latchclan.shop/api

Extracted

Family

latrodectus

Version

1.4

C2

https://remustarofilac.com/test/

https://horetimodual.com/test/
Attributes
  • group

    Ferrary

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Targets

    • Target

      ♦•Rèady•Fîlè•PassW0rd•Is•♦11148•.7z

    • Size

      8.0MB

    • MD5

      5658f6a118b93d6739fb6f5e7efd9d81

    • SHA1

      4a5bfbf68b0b464fa5702b23df7808eab7515291

    • SHA256

      b49e1e47ae0a7ccee75280b0d13405811dd343b6b619e20cb33eee80e16aa3f2

    • SHA512

      4100da7b792662e224244e36325152706b9599092b0a1cb23a6d6fec931a0a89729e8065e5e4d89b98454d43f052a54f6d0fa37acced287521e020c8ea8f985d

    • SSDEEP

      196608:Lr3VkNhAwfYGVfk/toNrjLtTpQhCv5VkAd7jyZvW0eW50YnYt:LZkYvGVfmarj5Tb8mjyZvPN51m

    Score
    10/10
    latrodectuslummadiscoveryloaderspywarestealer

    • Latrodectus family

      latrodectus

    • Latrodectus loader

      Latrodectus is a loader written in C++.

      loaderlatrodectus

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks