a84b92de3ce56084e9d687212a6d0a1f45c6ed2d064b3a6e792907a7ce7b59a8

Sharing

Copy URL Twitter E-mail

General

Target
lumma_sample.zip
Size 2.0MB
Sample260815-gmffdsfn91
SHA256 a84b92de3ce56084e9d687212a6d0a1f45c6ed2d064b3a6e792907a7ce7b59a8
MD5 162ad68685a32444fb2ce9b396833e84
SHA1 c15d9218ba0cc8bd7b7107699716b337e7397d32
SHA512 0adc17654cddf2e660cc8f7b324eaeed6fb628c699476cc45e971d665e0518346163dff11b043d215f1a1f13a73a07ba14b6d1840cd025b5a1b99d773b2c9cfc
SSDEEP 49152:W4MS/5Zi9TpLGhUepJqwSUiFmP+8Tbnfi9N+RhQU65agaMhdT:WrS/5ZijLGpjiF4bnK9N4GrBaMf
TLSH
T1A9A5332EAD1A3E44D26F963CDCC4DC88A850D9497B99F25E01606E4CAFF647035CBD8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  lumma_sample.zip
- Size 2.0MB
- SHA256 a84b92de3ce56084e9d687212a6d0a1f45c6ed2d064b3a6e792907a7ce7b59a8
- MD5 162ad68685a32444fb2ce9b396833e84
- SHA1 c15d9218ba0cc8bd7b7107699716b337e7397d32
- SHA512 0adc17654cddf2e660cc8f7b324eaeed6fb628c699476cc45e971d665e0518346163dff11b043d215f1a1f13a73a07ba14b6d1840cd025b5a1b99d773b2c9cfc
- SSDEEP 49152:W4MS/5Zi9TpLGhUepJqwSUiFmP+8Tbnfi9N+RhQU65agaMhdT:WrS/5ZijLGpjiF4bnK9N4GrBaMf
- TLSH
  T1A9A5332EAD1A3E44D26F963CDCC4DC88A850D9497B99F25E01606E4CAFF647035CBD8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Shared.props
- Size 12KB
- SHA256 0ed72bcbf0e2d5a995901c19287fb3a1973d10c7a5616508ae07b6398c3006ae
- MD5 c0f05c0592b8fb9ead2ca740979f8c4f
- SHA1 504b98028c92381b54668cd9583c9f02d557e2e8
- SHA512 fa727e8778f76781f0e17a32a49c9445dd92c1d31989291a0247124f765a15bc2899dd1114e926eaf765e2d560f79278db7e00d219e71064de30db850a82d737
- SSDEEP 192:EO5D8iVVZSGvnPfsS/NbC2OGlQCQ043BeYhXfPnCtv4+ienrNVzLfbRmJ4NT:EUOGPs+b6YQfBDHz+zDbRmJ4NT
- TLSH
  T12E4256B4E85D246AD36FE671D559FF08AA373187CBC73A69969BC0010F89B9E1B0503C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  SystemSecurityCryptographyEncoding.Internal.targets
- Size 46KB
- SHA256 1a193db6963f756ebe6f40213a946350a9fb972f8ac236c56894b4a3711c34f0
- MD5 a02c949ac341ef29ccfac7c183b125d9
- SHA1 da8db91bf4ab5f711dbbc7843f15bf543ce23cc1
- SHA512 f00653f48e499182d15457a9d85a06268c900f4d21244767fc0d64bb1c8c3e626865cdb3a52b3853ac9970813948c90fa4a92b6f74487645fda375fd1b3e0ea9
- SSDEEP 768:rfP0C0/hmvukH9fucY460U6W9xr9NLN4CnKjvMG4mhjpb2A42:rihk0cYLbN48KjvMGT128
- TLSH
  T1E723B6F8EACE58A8F6BFC12565ECBD99157232C797C21E64832CE0805BE6F857E0544C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  SystemSecurityCryptographyEncoding.csproj
- Size 9.2MB
- SHA256 a05780eb4e53ceecc2d8d93966a04865b234e610f2ac4ee886f1463148d8cc0e
- MD5 08bc84051190bb651633e35829c5c6bf
- SHA1 e04ee30f1a0ae6c0b52871c021e2c76509cbfa0d
- SHA512 09ae1b1ed82f67cf98a998f2a8463d4401ac6c8fcca0dc43cb4e7770ca1140c90bc99adfb40dc2aa1b4a753994fe99fb4213ff132cd52b9fcf8319180cc52a5f
- SSDEEP 1536:+IyufRodcrVVcKq3jVVfWx/vP223uGpjL6MyKWYfxCk/gzgr6JijHCV5FLQjnShq:+k
- TLSH
  T17FA6CE7B078047BBF3D447C4886B245E36F4E515BA25215AE77369EFBC2A9CB8078603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  SystemSecurityCryptographyEncoding.csproj.user
- Size 36KB
- SHA256 d77ca1af6d117f48c104030c10d3d2e14b660273bf886c3fcc09c9fe6b99b45b
- MD5 82d6aa36b10cbd4ca152d35ab396cee7
- SHA1 53ebb1dd2e29aa55a245bd12768291e7a6f42039
- SHA512 57e13056602ba83b0bb6e96abb1a15613e1074556188acd01c5b180f36d66c7847a9b3c4bd759723e17409aa2e42bcb4e91eeaebd247f038c34d5a1516ac8860
- SSDEEP 768:/JrjLDMzzor0QuWX4Uk1JWatJwFf1q2RRENzwmB+w56utwldXygG:ZLgHJUk1JWatJwFf1q2RRENzwmB01/Cp
- TLSH
  T133F2C170F85C7466C77FD6229999FE91973530ABC7CB3A385AA790824F5972B2B0403C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  cache_c92d6b.cfg
- Size 34B
- SHA256 1383d1e6e4904b248886ce813752d2c27756e94e063aea68cde994f22b8980e2
- MD5 fe5effeb6d382181d9974e6bf100b06c
- SHA1 e31a5972fce09794a2c0ef4504c7614eeb1731c6
- SHA512 418987a93b15e9d6aa757aaf05bd430bcccd3bea9b816c9d0cccf1e2d79f6eca2b818e084d36e5d17a78474f3c4d6436583d5f9699dd5cdd87953e0dc132c8e3
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data_4c62662.cfg
- Size 175B
- SHA256 245c5ae8797b966381ec0451dab255bccfc2486bdfbcdeedc3d94affc33f9912
- MD5 bd73969152a686735b0b03119bf921bf
- SHA1 a4843bd65b4976f59aad35ef56245c755f837275
- SHA512 284ce78a6e5b9c9dde1c4fe8e10ac6659f1d8b8a55f455a8694d57c30c07480b129b564c36e2965a1d429eeaa1dc3730631315f2e21349ed5b5b0690560c4435
- TLSH
  T11AC0226208006DB160C2D0984AD222240C98B6220D84248A42632238B24A300B3878F3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  runtime_0e96.log
- Size 68B
- SHA256 c2c3d4b0c2caa8ca1e4e6d5552e796483a598647a53dfdc0db78f3b78878e988
- MD5 1f6ed4aae3e5d71965cea35aa0c2b279
- SHA1 c7f7fdf92a7dc7a1c4926befc71ee2597247adcd
- SHA512 5df48474cc871fc77788a298200cbb78a8d85cba4a056b36aa6e898e8da5b3214cf539a52fc1ff5873aa9e9651192b87dc865eed747bdba391ec6f82967face9
- TLSH
  T170A0220C2B02003222800AA08023F8B080202020B0A80302C08233A2A28AC2B0000083
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  telemetry_4e13.cmd
- Size 1KB
- SHA256 e967fa04cd12bc4cb8c4d8e6ae0472578e876470509ed32ebb15a1eb5e31461d
- MD5 5c09a7605751cbb4046e3e71982a00b6
- SHA1 fae6cca28e84901f440743d2ec0c0e284f47e577
- SHA512 f682b3eb11b2ce3c60a7e76305c1fc2fc1206fd220ae9602973163ce86a4fddacb0cf901dd46ad84f99810669154008e3fbf9a5a65e1ffd0e6023908b474fbcf
- TLSH
  T174216796B126852999B037BA4B358733930E72833981F5ACB1A0CC9D74CF52DBA722D1
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18