lumma | 4543e3e46423dc20405590a8cd17529d5e057f2a3e33fb63a154af9b799cca30

General

Target

2025-05-08_36869ee9e3128724bd8dc18a35fa73d6_black-basta_cobalt-strike_ryuk_satacom
Size

1.1MB
Sample

250508-fjdlysysh1
MD5

36869ee9e3128724bd8dc18a35fa73d6
SHA1

b14dd8879e3189e0075c3147c8a4c85c7e2cc043
SHA256

4543e3e46423dc20405590a8cd17529d5e057f2a3e33fb63a154af9b799cca30
SHA512

dfec00bed9d02a5fba8461a3298602bec7e6fc5a9bfa8aab4749c60aafabb40a97cb4a293f2193ca3c7c11f6460fe6eabaead028a20a9d847a243a224d961173
SSDEEP

12288:A3VBED7WEv7+rJU6kxdQwf8/11Dyf0vOqCei7ZWPLCvvmlTJ7tf0vOqCei7ZWPLt:AXEfv7+Ehsuh7s+mLJsuh7s+mL

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://faeneasq.live/nmgj

https://orjinalecza.net/lxaz

https://eczakozmetik.net/qop

https://orijinalecza.org/jub

https://tortoisgfe.top/paxk

https://8eczamedikal.org/vax

https://orijinalecza.net/kazd

https://medicalbitkisel.net/juj

https://snakejh.top/adsk

Targets

- Target
  
  2025-05-08_36869ee9e3128724bd8dc18a35fa73d6_black-basta_cobalt-strike_ryuk_satacom
- Size
  
  1.1MB
- MD5
  
  36869ee9e3128724bd8dc18a35fa73d6
- SHA1
  
  b14dd8879e3189e0075c3147c8a4c85c7e2cc043
- SHA256
  
  4543e3e46423dc20405590a8cd17529d5e057f2a3e33fb63a154af9b799cca30
- SHA512
  
  dfec00bed9d02a5fba8461a3298602bec7e6fc5a9bfa8aab4749c60aafabb40a97cb4a293f2193ca3c7c11f6460fe6eabaead028a20a9d847a243a224d961173
- SSDEEP
  
  12288:A3VBED7WEv7+rJU6kxdQwf8/11Dyf0vOqCei7ZWPLCvvmlTJ7tf0vOqCei7ZWPLt:AXEfv7+Ehsuh7s+mLJsuh7s+mL
Score

10^/10

lumma discovery stealer
- Lumma Stealer, LummaC
  Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
  stealer lumma
- Lumma family
  lumma
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Lumma Stealer, LummaC

Lumma family

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2