lumma | f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98

General

Target

f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98
Size

258KB
Sample

230116-f2w61shg52
MD5

a8ce4ce944ac6514356635fe946d8ff4
SHA1

10557d7c007468792264f89563b607c6afb125fb
SHA256

f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98
SHA512

d04bc629b56a55ed427bef4d4e71a27ec3dbc94b6822ffe0d03cf1d43c4aa0b843c43a68a5d3fc36bbbf570f72eb9b8204b1d2a3ee1568e6a41eb2827784839c
SSDEEP

3072:qtz5NzRbLdEgdwiYvODvcEtlMQYolj5/GBAffydfPEz9rsu0jaUAZf7q/1iEcaVu:az7zRLdtVYvWzTXSKz9n0+U4zqQna

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98
- Size
  
  258KB
- MD5
  
  a8ce4ce944ac6514356635fe946d8ff4
- SHA1
  
  10557d7c007468792264f89563b607c6afb125fb
- SHA256
  
  f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98
- SHA512
  
  d04bc629b56a55ed427bef4d4e71a27ec3dbc94b6822ffe0d03cf1d43c4aa0b843c43a68a5d3fc36bbbf570f72eb9b8204b1d2a3ee1568e6a41eb2827784839c
- SSDEEP
  
  3072:qtz5NzRbLdEgdwiYvODvcEtlMQYolj5/GBAffydfPEz9rsu0jaUAZf7q/1iEcaVu:az7zRLdtVYvWzTXSKz9n0+U4zqQna
Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan
- Detects Smokeloader packer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1