lumma | cee49514eb30625566b08be7fcd20d7e3bf5152edca4d438819779b93dd4eae4

General

Target
0973dde3d7c9f3b25f4b823b2520156e.exe
Size 1.0MB
Sample250717-gerhpavyat
SHA256 cee49514eb30625566b08be7fcd20d7e3bf5152edca4d438819779b93dd4eae4
MD5 0973dde3d7c9f3b25f4b823b2520156e
SHA1 af982f3e1658e0e6e923c4ae3ec60333883db4d2
SHA512 a1e3b9624b87c065669793c613c001b010deff292961c36167778dfa0593371a5ff28678bf0c5cbe67f650aba084b3aaa9911870b2614239d6c9381a3ef3937d
SSDEEP 24576:a0acC5q+e2rP8LIxpK0ZX1RUdjiYkBiBKAZv8Agr/aCB:alXrP8yfZX1Ojr79vgr/ao
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://t.me/ahfdsdryw
https://hovve.top/qiwd
https://lnofi.xyz/qoei
https://ryxpq.xyz/tpaz
https://dzyzb.xyz/anby
https://dkkig.xyz/xjau
https://lodib.xyz/towq
https://josyfs.shop/zpad
https://urarfx.xyz/twox
https://genmkh.xyz/towq

Attributes

build_id
e3173568775c8b3b843494c446b7376e01ff8f

Targets

- Target
  0973dde3d7c9f3b25f4b823b2520156e.exe
- Size 1.0MB
- SHA256 cee49514eb30625566b08be7fcd20d7e3bf5152edca4d438819779b93dd4eae4
- MD5 0973dde3d7c9f3b25f4b823b2520156e
- SHA1 af982f3e1658e0e6e923c4ae3ec60333883db4d2
- SHA512 a1e3b9624b87c065669793c613c001b010deff292961c36167778dfa0593371a5ff28678bf0c5cbe67f650aba084b3aaa9911870b2614239d6c9381a3ef3937d
- SSDEEP 24576:a0acC5q+e2rP8LIxpK0ZX1RUdjiYkBiBKAZv8Agr/aCB:alXrP8yfZX1Ojr79vgr/ao
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lumma discovery spyware stealer
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Lumma family
  lumma
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ScoresInspections/What.vst
- Size 24KB
- SHA256 7bcb3ad39eb9ad7f0b6c77a465f13bc36aefa3ed93ed56d897c65664137fe614
- MD5 9d1aa0da45a0e394720582d6a715cf92
- SHA1 fc4509c6624ae3477fb925173bd439157c2e01fa
- SHA512 e7c492ed0505e3488cd06462d928f4445cd1dd3a03b0f97f6399fcbbefa1f1f0394f398e389fb09f27ff48897870c14da21e5981d449d20734c108c156a2ca71
- SSDEEP 768:RumfpvqVrnLO9wJ+tB1vC/P330b0/WlvHU:9vQrLOHT1Of0b0/WlvHU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6