lumma | 46e55e6ff8f39a1f6aeb07b038e14f7a794c017ddd6e5a51e5fdaca33ccd077c

General

Target

46e55e6ff8f39a1f6aeb07b038e14f7a794c017ddd6e5a51e5fdaca33ccd077c
Size

210KB
Sample

230116-fhvh3she32
MD5

41e38c3978f599bf1fc60b6bb5862b0a
SHA1

440b7da66c9a3ba22fb3bcf2eb80253c2d73b3f5
SHA256

46e55e6ff8f39a1f6aeb07b038e14f7a794c017ddd6e5a51e5fdaca33ccd077c
SHA512

148918a9d608efa0ad229c97449c100a60e3f4f2e3b971a30f149f35328895b1d4d4e76900da4ee655abdff14b471b864113aea1d59c28a270ef03528c487e37
SSDEEP

3072:xMXjiiy0W5hed5mr/SZ7fC8TOl+VPRwDoTQqaq6hKi:xIxWX3+Z7BO+VPGDo6

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  46e55e6ff8f39a1f6aeb07b038e14f7a794c017ddd6e5a51e5fdaca33ccd077c
- Size
  
  210KB
- MD5
  
  41e38c3978f599bf1fc60b6bb5862b0a
- SHA1
  
  440b7da66c9a3ba22fb3bcf2eb80253c2d73b3f5
- SHA256
  
  46e55e6ff8f39a1f6aeb07b038e14f7a794c017ddd6e5a51e5fdaca33ccd077c
- SHA512
  
  148918a9d608efa0ad229c97449c100a60e3f4f2e3b971a30f149f35328895b1d4d4e76900da4ee655abdff14b471b864113aea1d59c28a270ef03528c487e37
- SSDEEP
  
  3072:xMXjiiy0W5hed5mr/SZ7fC8TOl+VPRwDoTQqaq6hKi:xIxWX3+Z7BO+VPGDo6
Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan
- Detects Smokeloader packer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1