🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13dcfd68b5448ffeb7b9b5478e99ca51a043bebca13fed9a76d27e846481460c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13dcfd68b5448ffeb7b9b5478e99ca51a043bebca13fed9a76d27e846481460c
SHA3-384 hash: 592ae15cffa2414a74a3acd4c88c250187394acc033ce0da707c3e761de0cdd8dde6e4272add134eb026605146a5ca02
SHA1 hash: 30cce9a88a948288115d03c46488b4c472ef1d58
MD5 hash: 6b7e96697348b2eb0541bd1e908b8bdc
humanhash: ten-kentucky-arizona-washington
File name:Loader2.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:954'928 bytes
First seen:2024-08-06 21:08:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 952d690e7407c6921c33f330003b272a (1 x LummaStealer)
ssdeep 24576:WNAyGgMibaO1GAY/XyILkbcBbp8np7PY/OEnKW8d:/gMibaO1/YQbcBtup7kOH
Threatray 5 similar samples on MalwareBazaar
TLSH T15B15CE1235C1803AD67321320AA8F3B99FAFF5300B5956CF53D85ABA5F749C12B2661F
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter KnownStormChaser
Tags:exe lumma LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
426
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Loader2.exe
Verdict:
Malicious activity
Analysis date:
2024-08-03 13:57:04 UTC
Tags:
stealer lumma exfiltration
Link:
https://app.any.run/tasks/106666fa-f309-4348-8f5a-4706fc9286d6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.BorlandDelphiKo-1
Create hunting rule

Win.Keylogger.Lazy-10031941-0
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66b290f2aa5b40be0a9fb4bb
Tags:
Encryption Static Generic
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Behavior that indicates a threat
Connection attempt to an infection source
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint keylogger microsoft_visual_cc overlay packed
Link:
https://www.filescan.io/uploads/66b291012d2273a01ebea986/reports/da236327-57f6-4532-9269-6cdd5cba4f2f/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/13dcfd68b5448ffeb7b9b5478e99ca51a043bebca13fed9a76d27e846481460c
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/25e58627-5eb8-4abb-ac5a-313b2805eeae
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1489073
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Writes to foreign memory regions
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/13dcfd68b5448ffeb7b9b5478e99ca51a043bebca13fed9a76d27e846481460c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13dcfd68b5448ffeb7b9b5478e99ca51a043bebca13fed9a76d27e846481460c/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2024-08-03 16:59:18 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
29 of 38 (76.32%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cpop22fvish75n5zwvdy5gokkgqehpv4ue763gtw2j7iizebiyga._file
Verdict:
malicious
Similar samples:
13dcfd68b5448ffeb7b9b5478e99ca51a043bebca13fed9a76d27e846481460c
LummaStealer
d28e639d2945002bd214956679c4eacda104071f69309db6b807e32499019e4b
LummaStealer
f5c95b375996ff52798f587ee9359c8561896e66c1d70d19c0b4bbc9750a2581
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/240806-zze99s1amm/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Lumma Stealer, LummaC
Malware Config
C2 Extraction:
https://sulphurhsum.shop/api
https://empiredzmwnx.shop/api
https://boattyownerwrv.shop/api
https://rainbowmynsjn.shop/api
https://definitonizmnx.shop/api
https://creepydxzoxmj.shop/api
https://budgetttysnzm.shop/api
https://chippyfroggsyhz.shop/api
https://assumedtribsosp.shop/api
https://tenntysjuxmz.shop/api
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/32939aa4-efcb-4f27-ba77-88e560755cfa
Unpacked files
SH256 hash:
5ad91aefbe505d985fb62fa035c39e03607c6a4156ce6b0519ce07ba396c8150
MD5 hash:
5af8b9d4b0b15f3ab1df676972967ec3
SHA1 hash:
2b0c1b475d55707cc6919b9672fe871a0a978f62
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/390ad7d4-40bc-4ad5-8a89-ca7315915503/
SH256 hash:
13dcfd68b5448ffeb7b9b5478e99ca51a043bebca13fed9a76d27e846481460c
MD5 hash:
6b7e96697348b2eb0541bd1e908b8bdc
SHA1 hash:
30cce9a88a948288115d03c46488b4c472ef1d58
Link:
https://www.unpac.me/results/390ad7d4-40bc-4ad5-8a89-ca7315915503/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/13dcfd68b544/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/13dcfd68b5448ffeb7b9b5478e99ca51a043bebca13fed9a76d27e846481460c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::VirtualAllocEx
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
KERNEL32.dll::CreateThreadpoolTimer
KERNEL32.dll::CreateThreadpoolWait
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments