Overview

overview

10

Static

static

10

Injector_v1.07.exe

windows7-x64

3

Injector_v1.07.exe

windows10-2004-x64

10

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

scripting/...on.dll

windows7-x64

1

scripting/...on.dll

windows10-2004-x64

1

scripting/Cracker.dll

windows7-x64

1

scripting/Cracker.dll

windows10-2004-x64

1

scripting/Helper.dll

windows7-x64

1

scripting/Helper.dll

windows10-2004-x64

1

scripting/...ce.dll

windows7-x64

1

scripting/...ce.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Xdefiant_Cheats(UPDATED) (1).rar

  • Size

    16.4MB

  • Sample

    240527-y59wdsaa89

  • MD5

    6b9cfad00b2f02864768aa0132465603

  • SHA1

    2d8677e9ba17b5ebce2db0b75029d3d81f027b55

  • SHA256

    fc57397a75803becfc4bbef7ed49fa476a97f9be46014e2617602d27fcf5b3e8

  • SHA512

    f19fca8ce4bb73287eeb2f9185d8445e5dfc182df9edb2de42b9e4967dce25804b3243368c23f628a714210d47d93ba534879107fbf3095230be1c9f5e243d75

  • SSDEEP

    393216:A6JWj2bQVlUhcoiJwKrKUiVMUmYE8II3pZekl:9JbmmiJ7DHI

Score
10/10
lummaploutusstealer

Malware Config

Extracted

Family

lumma

C2

https://libertyliebindywv.shop/api

https://horsedwollfedrwos.shop/api

https://patternapplauderw.shop/api

https://understanndtytonyguw.shop/api

https://considerrycurrentyws.shop/api

https://messtimetabledkolvk.shop/api

https://detailbaconroollyws.shop/api

https://deprivedrinkyfaiir.shop/api

https://relaxtionflouwerwi.shop/api

Targets

    • Target

      Injector_v1.07.exe

    • Size

      10.2MB

    • MD5

      5a65fe3fa53e974779ccfe40dfecc98a

    • SHA1

      0caceef5d030306f57842e8e05149f84078c5fdf

    • SHA256

      0e2c6139f6ba0dd8e5d2da5b4af2633087ef292736d1c0d76119bfab820363bd

    • SHA512

      70e8943617f98aa20eae73bcd661e0dea8a36763f7324a1333ab31adc88a2f3f1a01cda88ce8bf4c757509491888be5e9dbaa367231d2b8d1a71b03ac92e82c9

    • SSDEEP

      196608:oQWAbjWZXrVcupUXIYtjvkuN1pxNm4eRoEGrSAU:XW+jWNVcupU4ivjvU4eRJGrS

    Score
    10/10
    lummastealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      libEGL.dll

    • Size

      400KB

    • MD5

      11e3271940091632a2c58216b0e9849b

    • SHA1

      c969c96e7a95498dc4a7cf349d3498f6ab9bb665

    • SHA256

      b32761ab539a94c123c51daf3b6fb86794f7b73ddb313c978eb0917741d2a939

    • SHA512

      1d0107c86e7352619f75c20a314bcf950c9a0cbd5dfd3ecd7fa1c3879b791edb2a64818dcd640b2cce1a2b5e99ad576bffea89dfceede785a6de6c15c222d6ed

    • SSDEEP

      6144:cAVXpNgQ3V3y+lBRrb3RuN8Nkp6mpbScfF+BHKTFcvLUP:ceUQF3y+lBR/BuDZGc6wyUP

    Score
    1/10
    behavioral3behavioral4

    • Target

      scripting/Addition.dll

    • Size

      30KB

    • MD5

      f22e849a370cdf127f48beab596bdd81

    • SHA1

      fb1da47c7a246f2cda7f7686a468efafd9933b1e

    • SHA256

      8be1f5581437b6f5ba48705e8956c8bc0765bbd1d6053242640c75bd94048aa9

    • SHA512

      6ded81fe4d4db69586d74fdb425c4fc8c092508e7e0b49eb141a9045abf40626d14659fa6237a3920e58571ca7acf4911cdf03c4307fd89b6dc5e54172afbc14

    • SSDEEP

      768:Fol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:er6tAugVjN4sXJYjqWdm2V

    Score
    1/10
    behavioral5behavioral6

    • Target

      scripting/Cracker.dll

    • Size

      56KB

    • MD5

      404aacc737a9d30147d30cee6be0abba

    • SHA1

      5f49b9197d73b53eb3473c80a6f25dc068421baf

    • SHA256

      3eec59d6aa2a45e368b99d09bcedf228290656a88de8a09ccc91867ab71f228c

    • SHA512

      eb3716304571727d3134da4da46c5c91276afa20f5da26f2b89cc0cdc19f98592322b5e85fdc6a36e51636298ffac456a9057ed7d10c17e4955c4307cb933f20

    • SSDEEP

      384:poaSsZTSyPG0TLMU9mCzkcu/b49Pji7iJI5TZCP56vS1a+dYUFv8WTa:W1yR8U9mCzkcu/8V2iP56v/+G0a

    Score
    1/10
    behavioral7behavioral8

    • Target

      scripting/Helper.dll

    • Size

      189B

    • MD5

      9bb9aba5dd893bbccfa45e2d75d55d26

    • SHA1

      5714796513341ac3159a6a3c23d4769209063d35

    • SHA256

      6b325cadd8992d998c4fbc8ed56079c2850b68ea2d38432d51c26ce82b0a5419

    • SHA512

      f57df9a4a02bd17772acb3ac1a0d961c53f6940600b58834ae38c198a98ae651a21b382450b267aeffbca4ab262668ae471a78ed99bf9dfa414c1316056a289b

    Score
    1/10
    behavioral10behavioral9

    • Target

      scripting/Resource.dll

    • Size

      10.7MB

    • MD5

      641dadbb3f03938da99bf7c6c4cc482f

    • SHA1

      b21bdb69a17642ade8e62fcbd779ff1bc89ea809

    • SHA256

      883aefb081a1f9ef974ceb16e12c215e92fee13531c052279404bd11b2f8e479

    • SHA512

      7aea5f0db9b261a17801124d6eef0df2d3ada4a6f624c8f4f2ee519a61171a3f06de9032493e3309a1a982fd1218613dde73a942942df2a8ec367e7f66a531f5

    • SSDEEP

      196608:8B4DNtjVoWhIdAXplnpnh4uIKZ2K245peMKU3lRM9RVIO+QvSNG2uM+XGE4:04vWGIun1GKZ/2aZKU3lRvO+QvQgGP

    Score
    1/10
    behavioral11behavioral12

MITRE ATT&CK Matrix

Tasks