lumma | 5402bb9bdc834258402ce782268c9099783e0ca7f9ead90a15827e7d3d3dcd54

General

Target

5402bb9bdc834258402ce782268c9099783e0ca7f9ead90a15827e7d3d3dcd54
Size

232KB
Sample

230116-l94tqahc9z
MD5

815a4342153b6263bb0d174c67d1a59c
SHA1

ffab6fa76ec5e563d9e6cc09c57dd5502eb3c979
SHA256

5402bb9bdc834258402ce782268c9099783e0ca7f9ead90a15827e7d3d3dcd54
SHA512

aff6974eab86d945d1a1151c3447604bc3629b1ce49da498064ed5c9b6b0f2b9c9a8090cf09361e31702d552bae508c15aef1c1305db4c97ac7ee447ea27e911
SSDEEP

6144:noQAJLuC4RZUjYziPqPUs9Cvz3jDHXyUC:noQ2y7RqPqPUsUvzfi

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Targets

- Target
  
  5402bb9bdc834258402ce782268c9099783e0ca7f9ead90a15827e7d3d3dcd54
- Size
  
  232KB
- MD5
  
  815a4342153b6263bb0d174c67d1a59c
- SHA1
  
  ffab6fa76ec5e563d9e6cc09c57dd5502eb3c979
- SHA256
  
  5402bb9bdc834258402ce782268c9099783e0ca7f9ead90a15827e7d3d3dcd54
- SHA512
  
  aff6974eab86d945d1a1151c3447604bc3629b1ce49da498064ed5c9b6b0f2b9c9a8090cf09361e31702d552bae508c15aef1c1305db4c97ac7ee447ea27e911
- SSDEEP
  
  6144:noQAJLuC4RZUjYziPqPUs9Cvz3jDHXyUC:noQ2y7RqPqPUsUvzfi
Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan
- Detects Smokeloader packer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1