# Lumma Stealer Domain

**URL:** <https://community.emergingthreats.net/t/lumma-stealer-domain/1651>\
**Category:** Rule Signatures\
**Created:** [May 18, 2024, 3:31pm UTC](https://community.emergingthreats.net/t/lumma-stealer-domain/1651 "2024-05-18T15:31:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jt42](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jt42/32/1046_2.png) [@jt42](https://community.emergingthreats.net/u/jt42)\
**Post date:** [May 18, 2024, 3:31pm UTC](https://community.emergingthreats.net/t/lumma-stealer-domain/1651/1 "2024-05-18T15:31:25Z")

</div>

A new lumma stealer domain: whispedwoodmoodsksl .shop

e0c5b755eb386a8ea0ab465fff797cd0 - [Automated Malware Analysis Report for a0724a317d7b22163de89adbca3514cfe556b23d1b0c4e3471e9c29901bba27b\_payload.exe - Generated by Joe Sandbox](https://www.joesandbox.com/analysis/1441932/0/html)

259f9fd891b465ee3fe7499712cf8eeb - [Automated Malware Analysis Report for 91trXZr1Ts.exe - Generated by Joe Sandbox](https://www.joesandbox.com/analysis/1441892/0/html)

---

<div class="post-metadata">

**Author:** ![bingohotdog](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/bingohotdog/32/42_2.png) [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\
**Post date:** [May 20, 2024, 7:12pm UTC](https://community.emergingthreats.net/t/lumma-stealer-domain/1651/2 "2024-05-20T19:12:59Z")

</div>

Nice! I’ll add this domain today.

Thanks for the share and also providing those sandbox runs.

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [May 20, 2024, 9:00pm UTC](https://community.emergingthreats.net/t/lumma-stealer-domain/1651/3 "2024-05-20T21:00:46Z")

</div>

Thanks @jt42 @bingohotdog !

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [May 20, 2024, 9:15pm UTC](https://community.emergingthreats.net/t/lumma-stealer-domain/1651/4 "2024-05-20T21:15:06Z")

</div>

@jt42

```auto
  2052787 - ET MALWARE DNS Query to Lumma Stealer Domain (whispedwoodmoodsksl .shop) 
  2052788 - ET MALWARE Observed Lumma Stealer Domain (whispedwoodmoodsksl .shop in TLS SNI)

```

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [May 20, 2024, 9:24pm UTC](https://community.emergingthreats.net/t/lumma-stealer-domain/1651/5 "2024-05-20T21:24:46Z")

</div>

Thanks @ishaughnessy !