lumma | c28e177f4a96a97f256b5919631a3aa1c2bd64e1ee193f9a47a8fa70dbb5fd8d

General

Target
Release.rar
Size 963KB
Sample260720-ndfhcsat9t
SHA256 c28e177f4a96a97f256b5919631a3aa1c2bd64e1ee193f9a47a8fa70dbb5fd8d
MD5 bc3158f149f55405909d1fa8bd94c006
SHA1 25a016e4d45c5f402eb18a329b8df45d09d81104
SHA512 0f07534ffa5670bb81ea05f4da1bf2e7ca99ba14a19b27cbdc729035fe7bf2a28457bf587826839bb6b0eeb03c7aa08e6e0210024832ffc517c29a900f1d22d8
SSDEEP 24576:fG0/tI78m7yLd2C0lMSiYWa2L7+IG4f9lZBBbwEB/sdD34I7ZW:XtIHy2PHiua7VlVf/EZW
TLSH
T19D252358DD4AB77208D0BB41E8A1509758FE77629B83408DBBACC49B4433B1CAE95FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://p3ar11fter.sbs/api
https://3xp3cts1aim.sbs/api
https://owner-vacat10n.sbs/api
https://peepburry828.sbs/api
https://p10tgrace.sbs/api
https://befall-sm0ker.sbs/api
https://librari-night.sbs/api
https://processhol.sbs/api
https://cook-rain.sbs/api

Targets

- Target
  Release.rar
- Size 963KB
- SHA256 c28e177f4a96a97f256b5919631a3aa1c2bd64e1ee193f9a47a8fa70dbb5fd8d
- MD5 bc3158f149f55405909d1fa8bd94c006
- SHA1 25a016e4d45c5f402eb18a329b8df45d09d81104
- SHA512 0f07534ffa5670bb81ea05f4da1bf2e7ca99ba14a19b27cbdc729035fe7bf2a28457bf587826839bb6b0eeb03c7aa08e6e0210024832ffc517c29a900f1d22d8
- SSDEEP 24576:fG0/tI78m7yLd2C0lMSiYWa2L7+IG4f9lZBBbwEB/sdD34I7ZW:XtIHy2PHiua7VlVf/EZW
- TLSH
  T19D252358DD4AB77208D0BB41E8A1509758FE77629B83408DBBACC49B4433B1CAE95FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery lumma stealer
- Family: Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Release/Executor.rar
- Size 963KB
- SHA256 dd9dbd0484c88e111103fa990789ca3ed01ad40d569d3d5c35baf34c2532e7f7
- MD5 6ab0abd018bf5687f0637537820cbcf6
- SHA1 4815dabd9656acfec4036a6c0d4b78326a253a14
- SHA512 8ef437266ed118b0ffc7481d69a1c065f57df3c2b49197326c676ab023105ba421c919ee91ef40022a7770e494a4773b97206fc16ae5f7e6d84ba1381897edc2
- SSDEEP 24576:lG0/tI78m7yLd2C0lMSiYWa2L7+IG4f9lZBBbwEB/sdD34I7Ze:NtIHy2PHiua7VlVf/EZe
- TLSH
  T127252358DD4AB77208D0BB41E8A1509758FE77629B83408DBBACC49B4433B1CAE95FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Release/Pa$$word.txt
- Size 14B
- SHA256 df7988558c4f12982e2ef6a6f0f276446cc6fe373f285aeb4bfee49c03e48c0c
- MD5 8d08d190ba5eb7dee16b6cd53bc8eb71
- SHA1 c656997c8a37a79c3c12ca524b644fff474bbef4
- SHA512 708a94dc39e6ade13b21c9034b68239be87d2980dbc87bba9d98b78043021eed0667b7fca2632a7778a755a951a4cbd0fb458a631253a16b79e9caffd9d136a1
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Lumma Stealer, LummaC

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6