MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09bcfef16ebdb6eb335b71ec950e173c7488c0b071e7ad217ef66acf1e9bc5a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09bcfef16ebdb6eb335b71ec950e173c7488c0b071e7ad217ef66acf1e9bc5a9
SHA3-384 hash: 0eb88e920ed0431795f5c90a7c2779e29aaa8a776c9c81de77d120ad6ae20862ef1512bedc0732e1405bc22845d23e24
SHA1 hash: f245ec07d53fbc3a9ee1309a006cac099a8548cf
MD5 hash: d466bda2f8c5f5fb0595547e5a97d843
humanhash: don-finch-music-shade
File name:SecuriteInfo.com.Variant.Mikey.154420.4177.25356
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'249'728 bytes
First seen:2023-10-07 23:50:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ae450531cb5f9358db13baf813ed0098 (2 x RedLineStealer, 1 x LummaStealer)
ssdeep 24576:A3mP+H6IB15219APGBwv1z0qo6a9DhvhComu0xzc9xrBX:A3z5219Auq1zNo6a3vVYc9BBX
Threatray 9 similar samples on MalwareBazaar
TLSH T152A57F1176FD0B59F5F30BB866BAA612487ABC6ADF11C2DF1251948E0D21FD08970B3B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
341
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Mikey.154420.4177.25356.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
DNS request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Sending an HTTP POST request
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Gathering data
Gathering data
Verdict:
Malicious
Labled as:
Mikey.Generic
Link:
https://www.hybrid-analysis.com/sample/09bcfef16ebdb6eb335b71ec950e173c7488c0b071e7ad217ef66acf1e9bc5a9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
LummaC2 Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b8460e25-d8be-481d-9bf3-051d5bc3fde5
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1321618
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Found evasive API chain (may stop execution after checking locale)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09bcfef16ebdb6eb335b71ec950e173c7488c0b071e7ad217ef66acf1e9bc5a9/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2023-10-07 23:51:06 UTC
File Type:
PE (Exe)
AV detection:
15 of 23 (65.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bg6p54loxw3owm23ohwjkdqxhr2irqfqoht22il66zvm6hu3ywuq._file
Verdict:
malicious
Similar samples:
65a68201d9709f5f3d07fe60b0b693983e2480197b6d9f570b6e78e49deade24
LummaStealer
68d9362e5c72da78824957e8e3fadc58f334b70e6764e01ced80027c2bf9d4df
LummaStealer
730f92cf3c550adcb289a67300715508b58a8b8747a9c6997e7b5233bcdebb5a
LummaStealer
bec28def672957143374413ca61cc8bc072551e0547d9597de026f2592b562fc
LummaStealer
c3c18c67df080ce7078698fc7e0ca38f17e53b62f9da673c5d3bb5f64de5f84d
LummaStealer
c6f86c6f03bb9a5d62a0989fb6d3bc1f69b8bd023e2346fe4425ddddaa77e418
LummaStealer
d2cfd66a33c6f1af2eb403108a578962b599a77b5cea6b4a06726a3c60ae8bca
LummaStealer
dd244d20e5646deac770faea203a978a2955efa2f3be320705ba498fc5b05187
LummaStealer
Result
Malware family:
n/a
Score:
  6/10
Tags:
spyware
Link:
https://tria.ge/reports/231007-3v5k5sag92/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Unpacked files
SH256 hash:
90fd9e2f129393f53e4797b19e687f9401143030c3a483f76581a1cb9ea9e730
MD5 hash:
7d148d0c75a5f09e509e4dbd03bce189
SHA1 hash:
4d6e8c0ab84d428e5ecc30f400bbe5b42b635696
Detections:
win_lumma_auto
Create hunting rule
Link:
https://www.unpac.me/results/d857662e-f0d3-473f-b2f4-1ab05840d634/
SH256 hash:
09bcfef16ebdb6eb335b71ec950e173c7488c0b071e7ad217ef66acf1e9bc5a9
MD5 hash:
d466bda2f8c5f5fb0595547e5a97d843
SHA1 hash:
f245ec07d53fbc3a9ee1309a006cac099a8548cf
Link:
https://www.unpac.me/results/d857662e-f0d3-473f-b2f4-1ab05840d634/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/09bcfef16ebdb6eb335b71ec950e173c7488c0b071e7ad217ef66acf1e9bc5a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 09bcfef16ebdb6eb335b71ec950e173c7488c0b071e7ad217ef66acf1e9bc5a9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2717841/
  
Delivery method
Distributed via web download

Comments