#lumma_310124

#IOC #OptiData #VR #Lumma #Stealer #AutoIt #7z #PWD #EXE

https://pastebin.com/0sqGs6aV

previous_contact:
30/01/24    https://pastebin.com/pgjwR07Z
27/01/24    https://pastebin.com/4B3hwvpx
25/01/24    https://pastebin.com/pwL5HdeX

FAQ:
https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

attack_vector
--------------
email attach .rar > .7z (PWD) > .exe > .pif (AutoIt) > h (Java Script) > C2


# # # # # # # #
email_headers
# # # # # # # #
Date: Wed, 31 Jan 2024 15:26:34 +0300
From: Цісик Царко <kaylee @ 2x4_com>
Subject: Для Бухгалтерії (Акт)
Reply-To: Тиханович Гордогост <webmaster @ barbershop - man_ru>
Received: from mail_brandincubatorlab_com ([52_137_103_248])
Received: from WIN - LCETV91VPS6 (plum - development2_aeza_one [79_137_205_213])
Message-ID: <73F848BA - F19C - 472A - A03C - 92CBC29E896D @ mail_brandincubatorlab_com>

# # # # # # # #
files
# # # # # # # #
SHA-256
File name
File size

SHA-256
File name
File size

SHA-256
File name
File size


# # # # # # # #
activity
# # # # # # # #

PL_SCR          email_attach

C2

    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    sofahuntingslidedine_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop,
    culturesketchfinanciall_ shop,
    triangleseasonbenchwj_ shop,
    modestessayevenmilwek_ shop,
    liabilityarrangemenyit_ shop,
    claimconcessionrebe_ shop,
    secretionsuitcasenioise_ shop,
    gemcreedarticulateod_ shop,
    sofahuntingslidedine_ shop

netwrk
--------------

comp
--------------

proc
--------------
Challenges + Egypt + Introducing + Widescreen + Band + Clip 20888\Training.pif
Hazardous + Extremely + Novels 20888\h

persist
--------------
n/a

drop
--------------

# # # # # # # #
additional info
# # # # # # # #
n/a

# # # # # # # #
VT & Intezer
# # # # # # # #
https://www.virustotal.com/gui/file/3feb0a8123f042428a88b4645f099ff8b4fca2e8f13c3b65b611f1dfb87fe3fc/details
https://www.virustotal.com/gui/file/dc18db364243fa2362cba6db1941a3aa2f73475810fffa31f21f69de32ae5160/details
https://www.virustotal.com/gui/file/6115d0dc0349f7cbab3fe4b4b769b389a60aab336519d4b42952bb0f0501428f/details
https://www.virustotal.com/gui/file/f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3/details
https://www.virustotal.com/gui/file/2a6a4bc5d24be31b8a3c2487f083cc5d846f48d6aa2cb1a8850b0bd136d5d517/details

VR