General
- Target quarantine.rar
- Size 20.5MB
- Sample260211-acn68act4b
- SHA256 093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9
Malware Config
Extracted
-
redline
-
ddwwnnll
-
196.251.107.104:1912
Extracted
-
lumma
-
https://unchewq.cyou/api
-
https://whitepepper.su/asds
-
https://hammernew.su/asdase
-
https://heavylussy.su/ccvfd
-
https://broguenko.su/asfase
-
https://homuncloud.su/ascasef
-
https://familyriwo.su/fssdaw
-
https://izzardtow.su/cascasc
-
https://basilicros.su/asdasq
-
https://chuckyr.cyou/api
-
https://oculusr.cyou/api
-
build_id
87a7c79e50a08b3e22c8346af7c9fec8cf93ca
Targets
-
- Target Cia2O5x.exe
- Size 2.5MB
- SHA256 038da7941cb395df589983f3b09346694fe2a3a9e458a295ebfd5bd7c9fdb434
Score7/10-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target EBoost.exe
- Size 2.3MB
- SHA256 b77f9f6a63826c6a207fb1a14f9caa977487b8b63b44aeeb4a0932b3748926e2
Score10/10-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
- Target LdlY2ri.exe
- Size 1.8MB
- SHA256 cd1c4a472f2b3d626cf59755ca4a86808f913f0da15a6b4c7632e9b68e0ab361
Score7/10-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target Loader.exe
- Size 359KB
- SHA256 ec7c5533adfb5a919951a4973983064b2103918bcf9f93a8c351a152a1f63567
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
- Target StatedPanasonic.exe
- Size 1.8MB
- SHA256 3a4440ce511cc7583d97e3cc2583bc456107d4c2fa562f11ecfb4ee89cb221c2
Score10/10-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target btZfO26.exe
- Size 2.0MB
- SHA256 efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce
Score7/10-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target build.exe
- Size 300KB
- SHA256 90223a0bf3a14fc840cc51baeced06fd17a7853a52537ab84fbeab4d050e5b90
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target candy.exe
- Size 61KB
- SHA256 863f8e761905985d4cba870b9aec44982cceb6209c05e72707522fd96e2d4e18
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
- Target hhKfuYso.exe
- Size 3.6MB
- SHA256 d7cd4233c352a34f396bc7176434e7e1c993cdc67fcffd96df8c06c02d7f671c
Score10/10-
Detects Vidar Stealer
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
- Target kRHhLlh.exe
- Size 2.0MB
- SHA256 809df87e75b0f659f2e4017692b1c66418fb6b458b7cf43b6ee918de14cf6ca1
Score7/10-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target lZDeIYoXVz.exe
- Size 2.8MB
- SHA256 3e153a7edb74f3950d50bcf968418184648a7f195fd81268f77525e9b97c6960
Score10/10-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
- Target rVYGceP.exe
- Size 6.4MB
- SHA256 30424b733fe17e1e601f5c2ddbd75a0979909835356d5d1e7bb27182da11ea13
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
- Target random.exe
- Size 5.2MB
- SHA256 c2cd34c0f4295339c1d611c5a9a4847be9da704e3454fe781f4af47540c0bb9d
Score8/10-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target request.exe
- Size 770KB
- SHA256 d9db8bdad5edd37400bb6b885f65a0aee158c8b6e3f517e8de9c6a114e3a40be
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Create Process with Token
1Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1