Pulse Detail — Threat Intelligence

PULSE NAME

LummaC2 Stealware

WHITE feisty-swim1410 2023-11-16 Modified: 2023-12-16

IOCs

HIGH VOLUME

The LummaC2 stealer malware strain has been identified as being used by threat actors operating under different aliases, according to a report published by the UK-based security firm Verdant.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1005 T1012 T1053 T1059 T1082 T1102 T1112 T1120 T1489 T1491 T1543 T1547 T1552 T1553 T1562 T1564

MALWARE FAMILIES

RedLine SectopRAT LummaC2

Indicators of Compromise (20 / 82 total)

All domain FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA256	51925d36298a3d9ceac6067fdc1ba1f799ef5c53553be95d6827192df0700d80	—	2023-11-16
FileHash-SHA256	04b99b0b9a0e98d04478003c86bf4fa3d20c56313c716b62e7be74ae7b95bf70	—	2023-11-16
FileHash-SHA256	0dc2ed3a68353261b09be0a93070ccfb23f48786be6ba548ed0f9c373befe110	—	2023-11-16
FileHash-SHA256	1522a865e9d583c3581fc19cafef5a41a7c7d0f759aaead3364045f300202305	—	2023-11-16
FileHash-SHA256	1a773948b5f177ca2e4561213ba2edeb08d4eeb05bd24635a1e7a2cbcd377bdd	—	2023-11-16
FileHash-SHA256	1d9d5cfc8ad162af6100cf3311f83608dab90bb8b3f41ccf9fc441718dd33970	—	2023-11-16
FileHash-SHA256	30efcdccc49589dc32e51f2f8fc269f45d5eb62dfafa3886f685cdd2214dd35f	—	2023-11-16
FileHash-SHA256	3347cc0b67cd8ad857d8f24b18a4c66776b1da6dbaac9b8fa077bda8218c73ab	—	2023-11-16
FileHash-SHA256	33c1d451e3a186d8734b27319b80036976cca882a6c531ddde9ad814cf42ef93	—	2023-11-16
FileHash-SHA256	42d504e5df2c5ab253c8cdc8dbd7332a0714789af1822946db74d8eb951da162	—	2023-11-16
FileHash-SHA256	4d5d3f9967db0ed61f9e48de6bab3f5b0a9f30e58da52e8b0dd8601e908f4743	—	2023-11-16
FileHash-SHA256	6e04b543db11048a0b57fe786c0c52441ded217252cd6564fc63ff84ee486f10	—	2023-11-16
FileHash-SHA256	72d2536c7a849a18bee4c3b574873371f05e8fcbd31f2b922f3231dbdce3f632	—	2023-11-16
FileHash-SHA256	79805092438a2e9b753b68a4cc97ad2107b68935f16903f38456e9b39e0ac3d3	—	2023-11-16
FileHash-SHA256	89014afb1dd2e694a44fe07caaa14e3878db7fff54c514937611757d1a1bc2c6	—	2023-11-16
FileHash-SHA256	93015b567e5ba8266205fb1183a6a26a3b950b67fd1366639ae232206d972f77	—	2023-11-16
FileHash-SHA256	c57b363df437c5ee108e0be22d63d6e2e8dc417246e3b13b18f3562cec2c5073	—	2023-11-16
FileHash-SHA256	c9094685ae4851fd5a5b886b73c7b07efd9b47ea0bdae3f823d035cf1b3b9e48	—	2023-11-16
FileHash-SHA256	f82a842c7d83381049ee3b1f29e54c80e08da5ecbb27101629efc615eca9fb61	—	2023-11-16
FileHash-SHA256	fb307e61f4ba0a09a023250422038b885d6926e9aa2027bcf56914d7a6a2f76a	—	2023-11-16

References (1)

↗ https://www.quorumcyber.com/wp-content/uploads/2023/09/Quorum-Cyber-Lumma-Stealer-Malware-Report-TI.pdf