MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 029cb71b11ee64c16cdaf203d594a1378808bf1a449459d4374a88882dc25aa4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	029cb71b11ee64c16cdaf203d594a1378808bf1a449459d4374a88882dc25aa4
SHA3-384 hash:	974ff4a9574eb99f3bd7c17897adff93fcb5a3e666f432c14f42c538bdcc3935e5ece514b4bc7ae94dd1430e37bf2cba
SHA1 hash:	b55b46bb73541b79b9da5bcdb5e1904eef878c19
MD5 hash:	40e8f66b4cd36eee423e33517465d3ca
humanhash:	item-mockingbird-leopard-juliet
File name:	sufferdemand.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'651'200 bytes
First seen:	2023-10-10 17:22:36 UTC
Last seen:	2023-10-10 17:38:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 68 x LummaStealer, 61 x Rhadamanthys)
ssdeep	24576:AM3vtdgCd6nwrULv/cILgCceU0PmpxdJaElkEmVDtjuB5/mMfs20JMV:7dgksMcvDLgCcOmLnaEWEuQ5dP0
Threatray	19 similar samples on MalwareBazaar
TLSH	T11F75232592DC00BFD57A43B556D38147A570B844BBACA1FB0194B0B47EA32F2317BB6E
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	00b2b0b2b2b0b200 (1 x LummaStealer)
Reporter	Anonymous
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

295

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

sufferdemand.exe

Verdict:

Malicious activity

Analysis date:

2023-10-10 17:23:08 UTC

Tags:

opendir lumma stealer

Link:

https://app.any.run/tasks/07cee563-5dc2-40d8-8ad3-6c8d42c5df5a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/452951/

Detection(s):

SecuriteInfo.com.Win64.Malware-gen.27457.30050.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file

DNS request

Sending an HTTP POST request

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

advpack CAB control explorer installer lolbin lolbin packed replace rundll32 setupapi shell32

Link:

https://www.filescan.io/uploads/65258877426c8727d6f7bef9/reports/36eac07b-a357-4dd3-a1f5-3aa7629e45a2/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/029cb71b11ee64c16cdaf203d594a1378808bf1a449459d4374a88882dc25aa4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d7987a3d-c737-4d4f-9135-88a038335269

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/029cb71b11ee64c16cdaf203d594a1378808bf1a449459d4374a88882dc25aa4/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2023-10-10 16:03:23 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

21 of 37 (56.76%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=akologyr5zsmc3g26ib5lffbg6earpy2iskftvbxjkeiqloclksa._file

Verdict:

malicious

LummaStealer

36a859a1fcd2f731adf2bcae4c59be9292f442313a22bdcc4b6275ea08086bd0

LummaStealer

90bb8de06b3450c6b63aa813597ed02a9fec7a1c2040a3271a0f5a7cdc145e66

LummaStealer

9554e7ef83f9c1aabed52be7a308d7e25c99e7d71e006146aee045d29784f92d

LummaStealer

a151dc5591395591d37f55a184a3b9f37e1ea1065ad7acdc2ad88b73654e8719

LummaStealer

bdf855ab17ba3f41611671ada67ce6972d8521d04a7c339b2f5dfdcf8a5146d2

LummaStealer

be8ccfb19dab5c8d7b4273dc77b34c7ca0afea516e6bf85f607904345a3ad54f

LummaStealer

f380115cce9725db41bba7feb4556265d22b6a284105e0412f86f71fe3bb8f90

LummaStealer

f40e1c8b377326be3e33ef49ddfb71fabf7af2f9a337a3c74784fc7f0356edcc

LummaStealer

f7b3f82ede7c4912eea7acea9aa344ee28b10cebe5b7a45a690651e9e40a8a4d

LummaStealer

+ 9 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery persistence spyware stealer

Link:

https://tria.ge/reports/231010-vx5d6aeh3w/

Behaviour

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

029cb71b11ee64c16cdaf203d594a1378808bf1a449459d4374a88882dc25aa4

MD5 hash:

40e8f66b4cd36eee423e33517465d3ca

SHA1 hash:

b55b46bb73541b79b9da5bcdb5e1904eef878c19

Link:

https://www.unpac.me/results/70abe809-b969-4b0a-9f69-62c77f1ff882/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.