lumma | 8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa

General

Target

8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa.exe
Size

240KB
Sample

240425-av9kwacc41
MD5

817d3b2845b7869b9fc71086755bef75
SHA1

62afe642e08e778593a54c053af79cb2efecbe6b
SHA256

8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa
SHA512

23fa2f5a78a1fcba86ec53b509d05fd8134a8d6466cf7aaffd7e39ef7ab812607eab0c40faea7512c4defdaa1c74ca7872504c5fae5597e3e0ae81bb990f453d
SSDEEP

3072:GHAEvKLe+EtqHInlgz3OWtd6IwYbF2u5u1SkLRaQedb:nL7EXlgzzOI3beUJ5

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

redline

Botnet

@cloudcosmic (https://cloudcosmic.store)

C2

87.121.105.175:14845

Extracted

Family

lumma

C2

https://strollheavengwu.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Targets

- Target
  
  8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa.exe
- Size
  
  240KB
- MD5
  
  817d3b2845b7869b9fc71086755bef75
- SHA1
  
  62afe642e08e778593a54c053af79cb2efecbe6b
- SHA256
  
  8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa
- SHA512
  
  23fa2f5a78a1fcba86ec53b509d05fd8134a8d6466cf7aaffd7e39ef7ab812607eab0c40faea7512c4defdaa1c74ca7872504c5fae5597e3e0ae81bb990f453d
- SSDEEP
  
  3072:GHAEvKLe+EtqHInlgz3OWtd6IwYbF2u5u1SkLRaQedb:nL7EXlgzzOI3beUJ5
Score

10^/10

smokeloader pub1 backdoor bootkit persistence trojan lumma redline @cloudcosmic (https://cloudcosmic.store)discovery infostealer spyware stealer
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2