lumma | 12ca778b2f964c751dedf8211fb4959be500022d1b26ce2d427b4736bb3fa9f2

General

Target

file.exe
Size

210KB
Sample

230116-av7raaee22
MD5

a272c2456368521390a3b920e88cd39e
SHA1

1eb4a8adb3fbb1a6a5478a97054865a17e596e17
SHA256

12ca778b2f964c751dedf8211fb4959be500022d1b26ce2d427b4736bb3fa9f2
SHA512

eff3f09fb644ab3e78b8ca9b6c838cc81efaa25d7a430444812f445e27f71cf5e14ac1ac33da00ee5b8f83865eb6abf47083e28cd1dd49dcc65fa1bbb1dfb65f
SSDEEP

3072:8YXj7gW0W5hed5Yu/BvIiER1Q50VM3MUAMOgbytz6yW0i:8sIWXfu5vJERO50VFUnOwoz2

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  file.exe
- Size
  
  210KB
- MD5
  
  a272c2456368521390a3b920e88cd39e
- SHA1
  
  1eb4a8adb3fbb1a6a5478a97054865a17e596e17
- SHA256
  
  12ca778b2f964c751dedf8211fb4959be500022d1b26ce2d427b4736bb3fa9f2
- SHA512
  
  eff3f09fb644ab3e78b8ca9b6c838cc81efaa25d7a430444812f445e27f71cf5e14ac1ac33da00ee5b8f83865eb6abf47083e28cd1dd49dcc65fa1bbb1dfb65f
- SSDEEP
  
  3072:8YXj7gW0W5hed5Yu/BvIiER1Q50VM3MUAMOgbytz6yW0i:8sIWXfu5vJERO50VFUnOwoz2
Score

10^/10

smokeloader backdoor trojan lumma collection discovery persistence spyware stealer
- Detects Smokeloader packer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2