MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f
SHA3-384 hash: 89b95a2f33116b2c16c3c2717741c535c1d360bfe0edf52056d3d3fe6b8b998dc4d71a93e54b0e61896ea3b431ac994e
SHA1 hash: 85bb57d35c69a159849b694b80618f1de6b8633c
MD5 hash: 4225b2ad70add8281a8d8ac6e1c5d9da
humanhash: oranges-music-jig-indigo
File name:download.txt
Download: download sample
Signature LummaStealer
Create hunting rule
File size:222 bytes
First seen:2024-09-18 23:21:07 UTC
Last seen:2024-09-21 15:29:49 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3:MoLXHPtwrWzZQXOaNsHnyMvZd2AnfxHBGQaiyJG95fVvfDMaDjX6MFIwp6HBGQaA:MuhCOxBfdBGQabC5fVHL6MFIsEBGQaA
TLSH T1BBD0A7BAB7199379C54057C2F81BF103F01F408DA252D54880BD604040A004283DD191
Magika powershell
Reporter Anonymous
Tags:LummaStealer powershell ps1 txt


Avatar
Anonymous
Retrieved from https://github-scanner.com/download.txt

Intelligence

File Origin
# of uploads :
2
# of downloads :
175
Origin country :
HU HU
Vendor Threat Intelligence
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ec744677496a3b0d6efa1f
Tags:
Generic Stealth Trojan
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
dropper masquerade packed
Link:
https://www.filescan.io/uploads/66eb609cbb9fe02b41b4ab01/reports/af8cea3d-57ef-43f0-abf0-246c237bdaad/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f
Result
Verdict:
MALICIOUS
Details
Malicious Scriptlet 2 of 7
Detected a malicious pivot typically seen during the 'file-less' pivot commonly seen in malware carriers.
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1514110
Signature
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
LummaC encrypted strings found
Multi AV Scanner detection for dropped file
Powershell drops PE file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Suspicious execution chain found
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cdkocw3dubzwqkm7ejcwmhl2iytm2gurvgkqupf62w2co3jnympq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_APT29_WINELOADER_Backdoor
Create hunting rule
Author:daniyyell
Description:Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

PowerShell (PS) ps1 10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31f

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3181145/

Comments