lumma | 1ce27fdc5a5869835ceaef65c07fc5cf0165d373aa9cae89a5f713d7d704fc29

General

Target

1ce27fdc5a5869835ceaef65c07fc5cf0165d373aa9cae89a5f713d7d704fc29
Size

207KB
Sample

230115-f1y9zsae66
MD5

e61bd1023de1c935149a998c33ae9f37
SHA1

f06f36974c483508c0616b5de63aa70472358b14
SHA256

1ce27fdc5a5869835ceaef65c07fc5cf0165d373aa9cae89a5f713d7d704fc29
SHA512

81999880f516b3b6b2ff584e4e8ae4b70e33fe2fcfb0ac15b8f3397e88666e1985d0b62a5660a32c5f6718ef374fa338a92be961dbf586c2a10d3fc9f3d8f475
SSDEEP

3072:ZXNhbS3y+k+BFCJ5vGgdBmRVDb5Lk3O5+n/06Pwx7apb:9fgy+k+uzPMRVDb58u6Pzp

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  1ce27fdc5a5869835ceaef65c07fc5cf0165d373aa9cae89a5f713d7d704fc29
- Size
  
  207KB
- MD5
  
  e61bd1023de1c935149a998c33ae9f37
- SHA1
  
  f06f36974c483508c0616b5de63aa70472358b14
- SHA256
  
  1ce27fdc5a5869835ceaef65c07fc5cf0165d373aa9cae89a5f713d7d704fc29
- SHA512
  
  81999880f516b3b6b2ff584e4e8ae4b70e33fe2fcfb0ac15b8f3397e88666e1985d0b62a5660a32c5f6718ef374fa338a92be961dbf586c2a10d3fc9f3d8f475
- SSDEEP
  
  3072:ZXNhbS3y+k+BFCJ5vGgdBmRVDb5Lk3O5+n/06Pwx7apb:9fgy+k+uzPMRVDb58u6Pzp
Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan
- Detects Smokeloader packer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1