General
- Target Receipt.377647.pdf.exe
- Size 31.5MB
- Sample260708-rxam1agv2s
- SHA256 924c4c76d6cebd2cd491313b7fa2d3afa6de4c433d680101bedadf03268dfcf4
Score
10/10
Malware Config
Targets
-
- Target Receipt.377647.pdf.exe
- Size 31.5MB
- SHA256 924c4c76d6cebd2cd491313b7fa2d3afa6de4c433d680101bedadf03268dfcf4
Score10/10-
Detect Lumma Stealer payload V2
-
Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Family: RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1