Extracted

• • Target
    2026-09-16_1caf613b6a86554da681696e292554e7_amadey_elex_luca-stealer_njrat_smoke-loader
  • Size 4.2MB
  • SHA256 4b667846f68d5d48a6aaf9d2a93bbe1db9a88409d0ae83cf42ce78bc2a88c2d0
  • MD5 1caf613b6a86554da681696e292554e7
  • SHA1 cfb80899d623232602bd38fa53ee45bde1e50b7b
  • SHA512 292e85f3700d45a1cd15739831112e5bd194d3adc10f8418337c8f4f189b2f915c32f8e1ad73fdc887ce7334d878b30c830844afe83e36057d8a970a037cdd55
  • SSDEEP 24576:omI2o2pTKK50xs56FGICCwhVtz7/vGuE:qIFKnI6FGlVtz7HGu
  • TLSH
    T1CA269D00F3A1C4B8F9B303F959B961696E2CBD91135454DF22C87AEE39316D1AC32A77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryspywarestealerlumma

  • Detect Lumma Stealer payload V2

  • Detect Lumma Stealer payload V4

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2