lumma | b6180b1a1f4146f798ad5137ec8439a9d3ad1ae9322f0c13a0e9be013aced2c8

General

Target
📦 𝕔𝕠𝕞𝕡𝕝𝕖𝕥𝕖⋡𝕦𝕡𝕕𝕒𝕥𝕖⋡𝕤𝕥𝕒𝕣𝕥⋡𝕖𝕩𝕥𝕣𝕒𝕔𝕥⋡𝕝𝕒𝕥𝕖𝕤𝕥 📦.zip
Size 43.5MB
Sample261011-qrq75astax
SHA256 b6180b1a1f4146f798ad5137ec8439a9d3ad1ae9322f0c13a0e9be013aced2c8
MD5 cd15a884535e0715bd1971841b09a59f
SHA1 9a238742c02dd05f741ed4985ab8382f8a19342c
SHA512 f0ff0d5565c026019da6910e379dfdc63164311834e4c6f16985b85cd5365b4d9bc897c61063fcd4e447a5646352171a20d5cc4117cca4575947bfeca0da4a5e
SSDEEP 786432:Ycu95/y1wqbx++0mlmPu0Ud8xTK4fvROMR0wbTOi2oToUqObWKyKU52htkzIgSg1:YcK5wwqtlwO8xJv8MRbTkSoBUWKYWt6j
TLSH
T155A73358FB77DDCF35F266BB3A9535B23A232894420EC9D64D6D3A1B608CB2D0070DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://ordinarniyvrach.ru/xiur
https://mastwin.in/qsaz
https://yamakrug.ru/lzka
https://vishneviyjazz.ru/neco
https://yrokistorii.ru/uqya
https://stolewnica.ru/xjuf
https://visokiywkaf.ru/mmtn
https://kletkamozga.ru/iwyq

Attributes

build_id
57ee25ea22a0a8c88d9d3fc2f5e5077c3c8bae2b9205cc81

Targets

- Target
  📦 𝕔𝕠𝕞𝕡𝕝𝕖𝕥𝕖⋡𝕦𝕡𝕕𝕒𝕥𝕖⋡𝕤𝕥𝕒𝕣𝕥⋡𝕖𝕩𝕥𝕣𝕒𝕔𝕥⋡𝕝𝕒𝕥𝕖𝕤𝕥 📦.zip
- Size 43.5MB
- SHA256 b6180b1a1f4146f798ad5137ec8439a9d3ad1ae9322f0c13a0e9be013aced2c8
- MD5 cd15a884535e0715bd1971841b09a59f
- SHA1 9a238742c02dd05f741ed4985ab8382f8a19342c
- SHA512 f0ff0d5565c026019da6910e379dfdc63164311834e4c6f16985b85cd5365b4d9bc897c61063fcd4e447a5646352171a20d5cc4117cca4575947bfeca0da4a5e
- SSDEEP 786432:Ycu95/y1wqbx++0mlmPu0Ud8xTK4fvROMR0wbTOi2oToUqObWKyKU52htkzIgSg1:YcK5wwqtlwO8xJv8MRbTkSoBUWKYWt6j
- TLSH
  T155A73358FB77DDCF35F266BB3A9535B23A232894420EC9D64D6D3A1B608CB2D0070DA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  𝑷𝑨𝑺𝑺 - 𝑪𝒐𝒅𝒆 == 2025.rtf
- Size 37.3MB
- SHA256 b4136559503630481c39f8a067b6412a91432e8decb92a421bd0ee5f029c9826
- MD5 821394174a958bf2ea2e1279b7e621b4
- SHA1 368fc16715458da08bb861145f4be6a62fa5a9d1
- SHA512 9e9d45af43d425593cef986a223cd30bd83438e8c9698fbebe76d4440be27e4ba851522631535f42292534ce3d02253bb23e37b0731d88ed4baffadbddf21084
- SSDEEP 24576:auwuwuAuwuwuwuwuwuwuwuojuwuwuwuwuwuwuwuE:W
- TLSH
  T15C8706B290AC6CD0D1CBD188698A7C9F09A7FBDBD8EB8E04279C42215D5CB556DE7F00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  📦 𝕔𝕠𝕞𝕡𝕝𝕖𝕥𝕖⋡𝕦𝕡𝕕𝕒𝕥𝕖⋡𝕤𝕥𝕒𝕣𝕥⋡𝕖𝕩𝕥𝕣𝕒𝕔𝕥⋡𝕝𝕒𝕥𝕖𝕤𝕥 📦.7z
- Size 38.5MB
- SHA256 526eaa6ebc6a197cf63ea3a932733acad00fabe6654bc029022739b8a4049b29
- MD5 ef03eb8c413e12fb629b5b36b9134058
- SHA1 42077b6f0c974455c1c163c8149cf224c5375801
- SHA512 72b7456ad7684bc102029061106f4600a927cfdb57ddd6f3c1d6aa4813f2c00b6c495f05f2f2822bb886c9e3e036417c76c42da8211a38578a89a8b9e50587f1
- SSDEEP 786432:6bx++0mlmPu0Ud8xTK4fvROMR0wbTOi2oToUqObWKyKU52htkzIgSghGwKEF:6tlwO8xJv8MRbTkSoBUWKYWt6SgrF
- TLSH
  T17297336CFE6799CF24729ABA31D9B0723A223D94421B86D69D6E3E47148CF1D0074CB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution lumma stealer
- Family: Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3