MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 6 File information Comments

SHA256 hash:	079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0
SHA3-384 hash:	87a2e03933827956f47ef1b9cee11e4f07623c148348e2e1fa98cc5a62d756afb24b4b10686002690e7e760b27574ce8
SHA1 hash:	e58fd94bbfccaa5d51cfaf71ed9de6e1fa5cf2b8
MD5 hash:	6936748e48384e4f4e50e6e8c6ee96c3
humanhash:	eight-west-maryland-march
File name:	079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'156'736 bytes
First seen:	2024-11-14 11:16:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c2c7c2a6f9720bd42ba4f057811dbee8 (3 x LummaStealer, 1 x PureCrypter)
ssdeep	24576:OwpOrt477q5ltoeMyOxVBQAFMs0Se2gcxKXLM02Oy8VZdFEFur7v:OwP7mleBxVBQAF10l2gcxK7h2Oygpw4
TLSH	T13C35E041F4D390A3F96361B033B8D1A96826F7F3E72809CF5264DB2855A9AD7453322F
TrID	49.9% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.6% (.EXE) OS/2 Executable (generic) (2029/13) 9.5% (.EXE) Generic Win/DOS Executable (2002/3) 9.4% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	exe LummaStealer repostebhu-sbs

Intelligence

File Origin

# of uploads :

# of downloads :

369

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0

Verdict:

Malicious activity

Analysis date:

2024-11-14 15:46:35 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/da2183c7-b361-4fa0-8cb1-dfe3f4f79fbe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PWS.Steam.37803.21390.6822.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6735dc766bc7caf979b2a639

Tags:

injection virus gates

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Verdict:

Malicious

Labled as:

Trojan.Stelpak

Link:

https://www.hybrid-analysis.com/sample/079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0

Malware family:

LummaC2 Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b0322250-63b4-4b85-8991-4f18786d7e43

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1555751

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0/

Threat name:

Win32.Trojan.LummaStealer

Status:

Malicious

First seen:

2024-11-10 16:46:02 UTC

File Type:

PE (Exe)

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a6piyik2bigvfwr6jzik5ppn6zdd5nsmkezm3kpqvka2c54z67qa._file

Verdict:

malicious

Label(s):

lummastealer

Similar samples:

error

LummaStealer

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/241114-ndpq2axpdz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Browser Information Discovery

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f750a8e3-f990-4fd9-8da9-c968dcdfc626

Unpacked files

SH256 hash:

f43139b10085929110ac7544c92f6f1649f6e0abe333188f566b46005501d608

MD5 hash:

28a928b19cf6009e667db317203f4aea

SHA1 hash:

d80475a219aa7e32b85ba3430f9ef7e602f4f559

Detections:

LummaStealer

win_lumma_auto

Link:

https://www.unpac.me/results/15247f6a-3dd7-4d52-a357-fc35737ae44e/

SH256 hash:

079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0

MD5 hash:

6936748e48384e4f4e50e6e8c6ee96c3

SHA1 hash:

e58fd94bbfccaa5d51cfaf71ed9de6e1fa5cf2b8

Link:

https://www.unpac.me/results/15247f6a-3dd7-4d52-a357-fc35737ae44e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/079e8c215a0a0d52da3e4e50aebdedf6463eb64c5132cda9f0aa81a17799f7e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW
WIN_USER_API	Performs GUI Actions	USER32.dll::AddClipboardFormatListener

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample