Overview

overview

10

Static

static

1

yollskare.zip

windows7-x64

1

yollskare.zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yollskare.zip

  • Size

    35.0MB

  • Sample

    240624-vwdj2stejb

  • MD5

    4887b175958a86cd26d2a117066a363c

  • SHA1

    a168a2c626ab02254a6e4b7f00352e9ee549d4cf

  • SHA256

    227447de76c7bcb29130c5b22705a2bf09bf8d648fc3448cb832ce8e6f9be15a

  • SHA512

    3cb6347662cb5b16e3bf6b7b43ddf8f4a0720d00c23ffd7c0ff4d14fdca5860284ca2b91e5d6c348d5845736206f87eb4792771efab8c3ebb45a8b41d29f2d98

  • SSDEEP

    786432:hMuCrZX2d1wN+KLj/BMWCJd/B2VgmrJD4KrtQHRfekgr5B+pe7Q/2bFK9+O++vtZ:qGd6N+k/ed/B8gcCKWRKvu2JK/

Score
10/10
lummaredlineinfostealerspywarestealer

Malware Config

Extracted

Family

redline

C2

185.196.9.26:6302

Extracted

Family

lumma

C2

https://employeedscratshj.shop/api

Targets

    • Target

      yollskare.zip

    • Size

      35.0MB

    • MD5

      4887b175958a86cd26d2a117066a363c

    • SHA1

      a168a2c626ab02254a6e4b7f00352e9ee549d4cf

    • SHA256

      227447de76c7bcb29130c5b22705a2bf09bf8d648fc3448cb832ce8e6f9be15a

    • SHA512

      3cb6347662cb5b16e3bf6b7b43ddf8f4a0720d00c23ffd7c0ff4d14fdca5860284ca2b91e5d6c348d5845736206f87eb4792771efab8c3ebb45a8b41d29f2d98

    • SSDEEP

      786432:hMuCrZX2d1wN+KLj/BMWCJd/B2VgmrJD4KrtQHRfekgr5B+pe7Q/2bFK9+O++vtZ:qGd6N+k/ed/B8gcCKWRKvu2JK/

    Score
    10/10
    lummaredlineinfostealerspywarestealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks