Extracted

• • Target

    f3b02bdb014a254fab986b14c350479004027e03127e8ce1ed72f94674d957cf

  • Size

    206KB

  • MD5

    92d0a6826636d3f7d4f3b0372c9c4023

  • SHA1

    6c8231914edf2d55403ccdb1b9047d43f838324d

  • SHA256

    f3b02bdb014a254fab986b14c350479004027e03127e8ce1ed72f94674d957cf

  • SHA512

    ff7dd3ac82211f26eeb625f37f8f4c58f358800487d1803faa5bdf6c6aaa5a2ae3863e69b0204181a386bfc4f1775457eef1a7cad74787918e3b9b50382087d5

  • SSDEEP

    3072:NX99be2Gn+SfafXyYT5syFlzrk2GCLtNqOcxtpeWapb:J+2Gn+Sf7rSlXvoMp

  Score

  10^/10

  lummasmokeloaderbackdoorcollectiondiscoverypersistencespywarestealertrojan

  • Detects Smokeloader packer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Sets service image path in registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1