lumma | bd09222e00af329436f92ffddb3d0b35bc2ba06142c28731a7701b1f02d035ab

General

Target

ebeca8f1f9b546f1ad993fc44dbd2f21.exe
Size

2.5MB
Sample

231228-qmzcyacba8
MD5

ebeca8f1f9b546f1ad993fc44dbd2f21
SHA1

cc81ced0e6f1fa731760a2e4a4d9a595775d6fa2
SHA256

bd09222e00af329436f92ffddb3d0b35bc2ba06142c28731a7701b1f02d035ab
SHA512

0d0b4bbbaee453493aa8ef716c475ee4d19c9fdfc67a6d34eb7134802ed51b8c8307db25093139eb2c0bb781d208795f367a9249397917428f2e41a81d62443d
SSDEEP

49152:P2/0Xf262LogWwJYgpW0VAyIYUA8nxuGYaxX2DdM200D3fimSLXzHqqq8XQ1uRik:Xf+cgWwJYLynZuud54yqmSLtX6uR2M

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

777

C2

195.20.16.103:20440

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

Targets

- Target
  
  ebeca8f1f9b546f1ad993fc44dbd2f21.exe
- Size
  
  2.5MB
- MD5
  
  ebeca8f1f9b546f1ad993fc44dbd2f21
- SHA1
  
  cc81ced0e6f1fa731760a2e4a4d9a595775d6fa2
- SHA256
  
  bd09222e00af329436f92ffddb3d0b35bc2ba06142c28731a7701b1f02d035ab
- SHA512
  
  0d0b4bbbaee453493aa8ef716c475ee4d19c9fdfc67a6d34eb7134802ed51b8c8307db25093139eb2c0bb781d208795f367a9249397917428f2e41a81d62443d
- SSDEEP
  
  49152:P2/0Xf262LogWwJYgpW0VAyIYUA8nxuGYaxX2DdM200D3fimSLXzHqqq8XQ1uRik:Xf+cgWwJYLynZuud54yqmSLtX6uR2M
Score

10^/10

google collection discovery evasion persistence phishing spyware stealer trojan lumma redline smokeloader 777 up3 backdoor infostealer
- Detect Lumma Stealer payload V4
- Detected google phishing page
  phishing google
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2