lumma | 5a28556b7baa532277625489fafd05cdc910e50a990d28bfead67dd2eafdc2b3

General

Target

82d198a3529f313b437d80c4abeed3e0.bin
Size

141KB
Sample

230116-kbxr3scb85
MD5

b55c7c8f4f40055da2b58292cdd8c5e6
SHA1

5d006cd21a000e222a0bf5bc959994526d6a2244
SHA256

5a28556b7baa532277625489fafd05cdc910e50a990d28bfead67dd2eafdc2b3
SHA512

7ded9b28b8673f8a225584bb3a28fa391c19a3e7c05f2c77a13d57f0d1fd929974b4bb98fddfb925b50de088fca571b62afd46acae510bb1666df5afc507314d
SSDEEP

3072:9nyhQLrEhTI9J/QPIOholKzsdTTwfyGYS5G+10QB6sXdnXBqAd:9yhgQhTacIOhITwa+x1SOdXBN

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  452591ae6a291b486e7e73be69f40cc62a0d9c4ab18e4d2369a0c6064be2604a.exe
- Size
  
  228KB
- MD5
  
  82d198a3529f313b437d80c4abeed3e0
- SHA1
  
  1c3cf1ec9f642dd4a784810d11c5b399ef9a8620
- SHA256
  
  452591ae6a291b486e7e73be69f40cc62a0d9c4ab18e4d2369a0c6064be2604a
- SHA512
  
  eaa3e9cde945523491516a982b3d3d1b9ac59b39768f46a7a50db357b4b1c89326f5a66031b1c23c0b4a35ef3965bb8c748581195ee78ef8de015bb5a378aecf
- SSDEEP
  
  3072:7sLYJ+f5GLqeTf3H+zKTXkifCvSSJFu+oukzYzWBkOuRGK:ILYJmK6KoiqvShukMzpjcK
Score

10^/10

smokeloader backdoor trojan lumma collection discovery persistence spyware stealer
- Detects Smokeloader packer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2