HijackLoader evolution: abusing genuine signing certificates
Oct. 15, 2024, 6:17 p.m.
Tags
External References
Description
A report by HarfangLab EDR and MITRE ATT&CK on the threat posed by the Lumma Stealer malware, published on 11 October, 2024, outlines the tactics used to deploy the malware.
Date
Published: Oct. 15, 2024, 5:54 p.m.
Created: Oct. 15, 2024, 5:54 p.m.
Modified: Oct. 15, 2024, 6:17 p.m.
Indicators
ff946f48f6bdf33d31f39614909115fead505c16426411897bd8e48362017d31
fecd6fc43e5198b7b4427c1e23cd62ca97820da25d2bdba67bd29b3d0f100fa5
fcb54e221a021ff3d57c52366169a13f86bed4c16d7e5bbddbfb6a315dc7bf3f
fa6e61f845c06cb9075806cfc8cb8ed7e1ca7dc956cce5eafbe99babf85d9e66
f158c65261bcab6e93927a219d12f596a4e40857bbd379f9889710ea17251e5e
f4350182d9a117138e47ce4622b3aa1ac9ebf2583f4932a6da78ea2ed7511a7f
fa58891a232e236bfde9d6103007624f0e83e17a9377bf4ac86af4bd087270d7
e72b171c1383bda2f72ad0e5cdcab833d1488c143ad9386b290d44cb2d67e702
e13aa5f31d2469fc4db4e54af711035ea79f63be591c0460982c0b6baf08e649
e4536f1dc62b6bae30e6da53cece729820bb27891a020b6a6cf7c4fe566f15a4
e02025280e22b826ab8997e2545406bf0c31e497f059155dc8412c34c8bad859
d465588501d2882d1a223516c4f66bcc44ea7211245fd49b9e61a64f94831614
d948e07325a1cf48bb9749e3f0a83d69c4abb96f822e3002b31b752ebb292c77
d022c579f3619b23b74fa31b6241feb542bf089cb52609256894da08f787d2f3
c73b23798aa9785f2e593db8ced278e0c325e4cb545bb9c8f9004165bd983b6d
c6e595d44257f293200b926123cea0f3cdbd622b32226758e907f9829d652833
c78b8771a5b897c03008c09241fdb07160264858f49c7398f9db681fc2003971
c20e98a4190f9063f9181d8d9fc01bb89e4e56cb888d4d8883c593586ff52a09
be0644373ab939d3e3d1766927039876b4c3511258dd5ecf3cb75f1dab5ac324
be03aa927c5d0d61ec21af9227f48e8c4d44c696c46f275bf7510998311912e8
a941faec5a25db96d6258d5c1e6c30f9f18ecf9937b63eb687b4d71a0af871f0
bdd338ff606d1e08ec16d13fbc5dee1e404ad2ae857a70e81bb23888beabf63a
a95276bc7b7474384166232e0ebe86a5e40ed6d1cdd103794b3b5af107a3eee3
8552afefa1cdcfe5889cf01bfae140e341c5bfb03188e65a45d2c8d90520e11e
9ef8d1845db29a2b4dc9e912e480bfad7e8007c96b1da364a5af123df7e01c29
970f0e2741f072e9b3c0fb5059e1d5610a8b53f50be65992a210884439c5643e
7c78454c853838a863c7a112e2c726e2b98d292906c73a1fa09b03cf421a5966
81fa2b7bd9d726d239b08595d1445efaa697ef45761551b966c3a3930288952d
81755e2da9fcc33dcd423c30a0ad4f9147b54dc1880721247631b34c31071de7
7544df9edd35749e132b8f586cef88127dcbea491ab128271fc3b2abd94e01d5
75da403841e014243fce87a1b666e02388c99fb96135e7c6fe5523ce2f51a5ca
7085f5baff8a1f39a4baf11b650aad21454eef8b0afd13f9c4338fed86b99785
6e0c83627427e5ec9c30569a851cc72cc003ea1c7ee182db3e4dae9392285a7b
6c58e8c3b998614567b4584cffc148e2382727997a754db68aa310881c2a5ba0
6abb9de7f6c663e542cd3d7b481b0907566f8c2acdacc6178091dacc7891d2b2
68242a96e0283db31f7a68f6e26df99e1a27fef1f1f9d732f0ddd0b8663ba3c6
6a3095d572991c4943f7a27dff4798d3b5286280115f7fab77a0a472ca0abdd9
649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9
5fac3606d6153531218a608ae5cb3f40f2421a41b18b0d58f3f7fdb56366732d
5ed854b4ed07250521f0da12b810128b014b2c6e83b8ba51b80dfa9e4252a3bf
5e450445b628d7c1a4c31e8bb6c951e24e0a0347660eccca6d851477462a0fd4
4be6e60d9880611a354d4c4c3097733fd7ce4812c40e7a4fc9e8fca569f329f6
40e21047850b9645143ac1febe703de2be9b6c9dc684840bebb61b09a0725a85
5c019e25c46cc13a4bc05ccacf2b783f9435bed724ae945d1508c69f3490a617
3d2f989bf5887b1dbbfbb0030ed0e4c304dd0e6123a1e10e798ee3eb10c87f8b
39551715b734f4a331dd0b39a953a79567f642dc38bfa173f9849a4dbdd7d34e
402aacbb8dc07d96733eee2292f709d89d65efbe82d55e0dd4b7764cdde287b5
365ed11bf82a3f59768195ab7971b6955ec0ab883b5e800c63339a4105bdec95
34fea0c0708ecfceb592029910626ca699fb5f18595599d47a9ec87749940884
3450b57ff0d7f8cd7f14258d1e0e851487b5beac599a024f91f31c15e9deb075
315e6d1736e2ec8465a172d289a6520ec127e1b02190716b383226275672170b
315615abe0592af8ae3c90b6ad3b18047084612b49699a6f26eafe1dc747d773
27ed09b6bbce8c6306640adf76d6dd1f3b97c406915d72b215165fe1c5615ac7
26ab5cf8df71135baf2661864f7d5a62262688a018f7450c5de962433c2b99c9
25e0344b3c4d17a34f59423d45c5e95015ac347e0040e51b2d5df81f3b8ceb83
25c2c9648b5be95c0a61f043f2a9e5703373c3831edbe8cc8b7c857b405f172a
23a229c4b053f26ed5303447c17edf0ee6b02535692a558e158b3b03087bec87
20cfcd8c67b83b282e3aac028a166539a26d44129c9860ea7464feed5a123818
1839b7152814b16b9f28326081f16bf9c5bbbb380005232c92d25c9a3e36e337
17926b988b31296c26bf8fcc5be5595f8b290112949cd9314b3ddb51216a9fc6
174432fd986530d149a229fa4cfbb0bfe19fc9a6a52efd405a5da02c90a7f9fd
137a54acfc324a120335bd1b9a397cb5fd7e7709b0980ac3eaeb03fa7764f259
11a6ee07c004d8c7469a9cf30b9b084ea786613a5481fcdf78ce5a2634ad2f02
0d40a18d67005a5ade12b5593df3cf9e7ae996bebedacad64de81de3ffb9821a
0c8f2c06eaba300751add819f419458b06acaea47b8b5983fab710a67a074873
0a6df5fb902be0b4b0ed9bfb4f53df4ab54391458a7d8833d524d16d46b33f33
04675527ea934ff3450cf20900b7233a8a86125b5f3042d97d3a6e349631f307
Attack Patterns
Lumma
T1574
T1218
T1553