lumma | 757e110de59c814b23d84c12fe136119a1bfdaa212f8e91d6d54be66047c1e54

General

Target

2025-05-08_9ced5ae8c6955278c5e9d9dfb5ceff84_black-basta_cobalt-strike_ryuk_satacom
Size

1.1MB
Sample

250508-f9jwnaywaz
MD5

9ced5ae8c6955278c5e9d9dfb5ceff84
SHA1

95e262bb27aac2d5a7e41c2846084274ff310f62
SHA256

757e110de59c814b23d84c12fe136119a1bfdaa212f8e91d6d54be66047c1e54
SHA512

a95efb936a038b419985cedc633514d89bcd0c91021eaaabf07d0242b9c17b1da3632aebadb22bac48e05fe513c5f428db5cec16cb0da372733035c30c4f1139
SSDEEP

12288:bzpkncANLF4f2651PBXKI3YYu2t8lv3ZoDgNE7aOKI3YYu2t8lv3ZoDgNE7a2EO:bzpkcOCVXfIYil/ZormOfIYil/Zorm2t

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://vecturar.top/zsia

https://6stuffgull.top/qwio

https://ariosefqcu.shop/wrqo

https://2homewappzb.top/tqba

https://tortoisgfe.top/paxk

https://descenrugb.bet/woap

https://onemiltxny.shop/tqiw

https://octalfbsh.bet/mben

https://snakejh.top/adsk

Targets

- Target
  
  2025-05-08_9ced5ae8c6955278c5e9d9dfb5ceff84_black-basta_cobalt-strike_ryuk_satacom
- Size
  
  1.1MB
- MD5
  
  9ced5ae8c6955278c5e9d9dfb5ceff84
- SHA1
  
  95e262bb27aac2d5a7e41c2846084274ff310f62
- SHA256
  
  757e110de59c814b23d84c12fe136119a1bfdaa212f8e91d6d54be66047c1e54
- SHA512
  
  a95efb936a038b419985cedc633514d89bcd0c91021eaaabf07d0242b9c17b1da3632aebadb22bac48e05fe513c5f428db5cec16cb0da372733035c30c4f1139
- SSDEEP
  
  12288:bzpkncANLF4f2651PBXKI3YYu2t8lv3ZoDgNE7aOKI3YYu2t8lv3ZoDgNE7a2EO:bzpkcOCVXfIYil/ZormOfIYil/Zorm2t
Score

10^/10

lumma discovery stealer
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Lumma family
  lumma
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lumma Stealer, LummaC

Lumma family

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2