Extracted

• • Target

    1e8f6fb57172cb62c427fadea2dffdafb6eed0a74d1f4960e690a1b367bc1bed

  • Size

    206KB

  • MD5

    0f9e5343f1307812501daad61f396747

  • SHA1

    1db3279b3d6cd375ae146f99fff85d93a05c8c0a

  • SHA256

    1e8f6fb57172cb62c427fadea2dffdafb6eed0a74d1f4960e690a1b367bc1bed

  • SHA512

    2827a15ed0f5521c1dc65444c6c9537d59c76927acf5a6d607175f29f9d74bbf4ddfff0d31164968a159cf27e401b7b828d8fd0e7641a4ec44978508bed61f17

  • SSDEEP

    3072:jXtOxmlgJeAu5TGmtU56y2ndku7c0KB8a15xii:bDaerGmtU56y2ndf7cBBH1r

  Score

  10^/10

  lummasmokeloaderbackdoordiscoverystealertrojan

  • Detects Smokeloader packer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1