lumma | de4cf4266de87614872aab673e8c92d07933ebcd1390a0e85f46a7544ff2b37e

General

Target

de4cf4266de87614872aab673e8c92d07933ebcd1390a0e85f46a7544ff2b37e
Size

207KB
Sample

230115-k7462acg82
MD5

fe2648ff5d2ae4f0c9355f261677b258
SHA1

be7f19eb23ca3236921ebaa508887ed89e8e6881
SHA256

de4cf4266de87614872aab673e8c92d07933ebcd1390a0e85f46a7544ff2b37e
SHA512

f97343f93ed6ae124c6926429d1f1c23d9ef6482b3a62f0e0f88dfefa53122bb0deeefed9ef3cf073f863d70a18899225203cfa254db39aa24a8d99ed82aa416
SSDEEP

1536:y0tQukweXQwYFJUT2Dsnyhf/DUY7P7K5z7L/nD5djJ1gBdAWGOICB1kDzzTZCgAH:fXte80JQRKfD5/IAW+CQb1BYebD4ori

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  de4cf4266de87614872aab673e8c92d07933ebcd1390a0e85f46a7544ff2b37e
- Size
  
  207KB
- MD5
  
  fe2648ff5d2ae4f0c9355f261677b258
- SHA1
  
  be7f19eb23ca3236921ebaa508887ed89e8e6881
- SHA256
  
  de4cf4266de87614872aab673e8c92d07933ebcd1390a0e85f46a7544ff2b37e
- SHA512
  
  f97343f93ed6ae124c6926429d1f1c23d9ef6482b3a62f0e0f88dfefa53122bb0deeefed9ef3cf073f863d70a18899225203cfa254db39aa24a8d99ed82aa416
- SSDEEP
  
  1536:y0tQukweXQwYFJUT2Dsnyhf/DUY7P7K5z7L/nD5djJ1gBdAWGOICB1kDzzTZCgAH:fXte80JQRKfD5/IAW+CQb1BYebD4ori
Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan
- Detects Smokeloader packer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1