MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments 1

SHA256 hash:	06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6
SHA3-384 hash:	b774abd5550efc04387e68878bacca4de7f1bd823876cb46f9b8c7a60eb6814a749d29f6612b8cba6f7d4f6049051f55
SHA1 hash:	2f08e4304eb3918b136ed53700cf7b8cce5e58e8
MD5 hash:	f4d57589a7db46677d1ced8f8123feda
humanhash:	earth-two-angel-lamp
File name:	f4d57589a7db46677d1ced8f8123feda
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	317'952 bytes
First seen:	2024-06-13 06:22:46 UTC
Last seen:	2024-06-13 07:27:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fda332609aae506e39655ec159c5e3fe (3 x LummaStealer)
ssdeep	6144:3lGhYe2gss2fHZq4uCDrgcKJCMBus902mdK/WI5OKkKKKDi4G:3lGhYHh0CnYZSLPpKKKD1G
TLSH	T1B1647C16D733A1F1CC4A5575307BB33F49382A0653284EE7DBA0EB8166937A3E876D09
TrID	42.7% (.EXE) Win32 Executable (generic) (4504/4/1) 19.2% (.EXE) OS/2 Executable (generic) (2029/13) 19.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.9% (.EXE) DOS Executable Generic (2000/1)
Reporter	zbetcheckin
Tags:	32 exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

366

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6.exe

Verdict:

Malicious activity

Analysis date:

2024-06-13 06:25:42 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/3ca5a895-ef34-45c2-b75d-e37fdecf854c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.16623.15606.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=666a9112da262547655ec7b3win7simulatehigh_evasion

Tags:

Variant

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ddb7afa5-4c27-4c25-8b93-6d5c999a5c75

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1456378

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

LummaC encrypted strings found

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6/

Threat name:

Win32.Trojan.LummaStealer

Status:

Malicious

First seen:

2024-06-09 19:49:09 UTC

File Type:

PE (Exe)

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a2ydhukjt7xvuf33lz3l3jplkm5gpcfstfnxzxahmw4yz2skg63a._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240613-g5gfea1eqp/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1dbdcfbf-1b50-464b-9076-a1b559db41b0

Unpacked files

SH256 hash:

06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6

MD5 hash:

f4d57589a7db46677d1ced8f8123feda

SHA1 hash:

2f08e4304eb3918b136ed53700cf7b8cce5e58e8

Detections:

LummaStealer

Link:

https://www.unpac.me/results/4796006a-6b7b-4403-ad6d-cc3c4e52fb40/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 06b033d1499fef5a177b5e76bda5eb533a6788b2995b7cdc0765b98cea4a37b6

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2886086/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CoInitializeSecurity
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::GetSystemDirectoryW
WIN_USER_API	Performs GUI Actions	USER32.dll::OpenClipboard

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-06-13 06:22:48 UTC

url : hxxp://77.91.77.81/lend/luma22222.exe