Overview

overview

10

Static

static

10

031f0b4bce...cs.exe

windows7-x64

10

031f0b4bce...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics

  • Size

    3.3MB

  • Sample

    240514-wb5y8sha68

  • MD5

    031f0b4bce3ba22d9e46cbeec1b73360

  • SHA1

    4d6899fff97cff74a188c772aacfee3ea73731e6

  • SHA256

    0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117

  • SHA512

    f1bd60f3989d56f7775956347f03e8b69f36f4424ecf6bdbb818c9cc4ac4f4ac16e32a21ff3a096acc1ea69f9b98126d42b582e9556ecec2503042b12217279f

  • SSDEEP

    49152:B6Ee3j3piO4kHpKW4l4Gkdnx6KUnUa7ufJcbHpmqn8W42LQEKJWAOfraP:B6x3vZ4mGkz6KUr7ufJFiy60WAOfraP

Score
10/10
lummazgratratstealer

Malware Config

Extracted

Family

lumma

C2

https://sloganprogrevidefkso.shop/api

https://sofaprivateawarderysj.shop/api

https://lineagelasserytailsd.shop/api

https://tendencyportionjsuk.shop/api

https://headraisepresidensu.shop/api

https://appetitesallooonsj.shop/api

https://minorittyeffeoos.shop/api

https://prideconstituiiosjk.shop/api

https://smallelementyjdui.shop/api

Targets

    • Target

      031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics

    • Size

      3.3MB

    • MD5

      031f0b4bce3ba22d9e46cbeec1b73360

    • SHA1

      4d6899fff97cff74a188c772aacfee3ea73731e6

    • SHA256

      0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117

    • SHA512

      f1bd60f3989d56f7775956347f03e8b69f36f4424ecf6bdbb818c9cc4ac4f4ac16e32a21ff3a096acc1ea69f9b98126d42b582e9556ecec2503042b12217279f

    • SSDEEP

      49152:B6Ee3j3piO4kHpKW4l4Gkdnx6KUnUa7ufJcbHpmqn8W42LQEKJWAOfraP:B6x3vZ4mGkz6KUr7ufJFiy60WAOfraP

    Score
    10/10
    zgratratlummastealer

    • Detect ZGRat V1

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks