Overview

overview

10

Static

static

3

r1ng_spf.exe

windows10-2004-x64

10

r1ng_spf.exe

windows11-21h2-x64

10

r1ng_spf.exe

windows11-ltsc_2024-x64

10

r1ng_spf.exe

macos-10.15-amd64

1

r1ng_spf.exe

ubuntu-18.04-amd64

r1ng_spf.exe

ubuntu-22.04-amd64

r1ng_spf.exe

ubuntu-24.04-amd64

Sharing

Copy URL Twitter E-mail

General

  • Target
    r1ng_spf.exe
  • Size 2.1MB
  • Sample260621-yfn8dsfz4t
  • SHA256 5588d2cb4f38ec65c848659138eac387a2b649779c694c0a03b346fb4a6ca205
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lummadiscoverylinuxmacosstealer

Malware Config

Extracted

Family

  • lumma

C2

  • https://rodformi.run/aUosoz

  • https://metalsyo.digital/opsa

  • https://ironloxp.live/aksdd

  • https://navstarx.shop/FoaJSi

  • https://starcloc.bet/GOksAo

  • https://advennture.top/GKsiio

  • https://targett.top/dsANGt

  • https://spacedbv.world/EKdlsk

  • https://galxnetb.today/GsuIAo

Attributes
  • build_id

    1da5b711f365cbf6bbd1a17ef9c4a38bbf76ede874fe82

Targets

    • Target
      r1ng_spf.exe
    • Size 2.1MB
    • SHA256 5588d2cb4f38ec65c848659138eac387a2b649779c694c0a03b346fb4a6ca205
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverylummastealer

    • Family: Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7

MITRE ATT&CK Enterprise v16

Tasks