MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 18

Intelligence 18 IOCs YARA 5 File information Comments

SHA256 hash:	1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d
SHA3-384 hash:	03ba52ba3411b4532c50ec3b5ef585fc7df34eba2c3e12a50f365cd79d1c734efeef38713344ff4219c9ce5e26caedd1
SHA1 hash:	9cfe211ddd3881eafb3348c54b7b35561d8baea4
MD5 hash:	58f95551c34e55c2281e796fde42c140
humanhash:	fish-sad-glucose-five
File name:	1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	574'976 bytes
First seen:	2024-10-27 17:15:45 UTC
Last seen:	2024-10-27 19:23:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a7fabbd1843b9f07d379ea3fcf5b3d9a (1 x LummaStealer)
ssdeep	12288:CJ87nB8kWKPRzPkN1v4ctCQuKE8QNR3cnUmYxbUI3kJc:CJLkWcLkN9jtCQun8H7YmIs
Threatray	30 similar samples on MalwareBazaar
TLSH	T117C4F1227480C4B3C63279320AE0DBB95F7DF9704E651B9B67984B6F0F70681A731B66
TrID	32.2% (.EXE) Win64 Executable (generic) (10522/11/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Chainskilabs
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

385

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4dN

Verdict:

Malicious activity

Analysis date:

2024-10-27 16:21:30 UTC

Tags:

lumma stealer possible-phishing exfiltration

Link:

https://app.any.run/tasks/128f775c-3d0a-42f0-880c-66105850d191

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PWS.Lumma.729.12551.6338.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671e7558a75e41aa67226e2e

Tags:

Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Unauthorized injection to a recently created process

Restart of the analyzed sample

Searching for synchronization primitives

Connection attempt to an infection source

Launching the default Windows debugger (dwwin.exe)

Query of malicious DNS domain

Sending a TCP request to an infection source

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/671e75542734cb737d8eed72/reports/206ea8c5-a2ff-4ce7-af71-42c99bad4a39/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

LummaC2 Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5fa31623-d24a-4ea7-ae34-88f814678917

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1543345

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d/

Threat name:

Win32.Trojan.LummaC

Status:

Malicious

First seen:

2024-10-23 05:24:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cukowhy4dxigfy2aypgt3lebaozdmivzcdxzgjywvdi7r6g6xngq._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

21424c9386ed6c518f89ffd488b7d32e64c34d1c9162c5935db4bf29efb72e32

LummaStealer

56b595884990bb8b2ca455ccc13f376d7d6db15b55fe44c89bf670e1839f3945

LummaStealer

a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7

LummaStealer

a83daf726f41df7b8704e7de5e810af1f92186eb46326e39eba9bcd3ba44ec72

LummaStealer

ba833b2b6210b781718e625b632e46751ab28582a5f1e475c44a425b3409ee2a

LummaStealer

cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8

LummaStealer

error

LummaStealer

+ 20 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/241027-vs48la1bll/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://conceptionnyi.sbs
https://platformcati.sbs
https://nervepianoyo.sbs
https://qualifielgalt.sbs
https://smashygally.sbs
https://fightyglobo.sbs
https://modellydivi.sbs
https://pioneeruyj.sbs

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b5c5d75e-b1f7-4381-96ed-e6b7d506f006

Unpacked files

SH256 hash:

6e3a3bbf6478c8e6c63d22f887a00fc8655e10212e16bf87fdcbc7306f7ea569

MD5 hash:

19f6446cf95c440e28c519ccfa46e07a

SHA1 hash:

b6d6ed35f3a7df542d788456a6478550da339fac

Detections:

LummaStealer

Link:

https://www.unpac.me/results/7997e90d-1746-45fe-9280-5b9fc0c70f4d/

Parent samples :

cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8
885c6941d87ec16785da0ebbffd5334c06a5a1344b67f603937917b9ace9504d
a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7
bffe5190d5f063e1d2650a4282d4ea0fd3f02e824773c7dc767ef915089db457
b1621c26902c7492590479c9739e9271ea8ff066bc2c2eed9ce1f8599da328d1
8456cc2d2a31cb075f95053c8eb886a47ba8381a2ba2fbe0866120fb24ff41bd
5bd0a7c399000541ab5f7398af02d5ced96e4f3adcea59a63c35dcf890bdc8de
f63fec027d91bf28bf3e219ee984a500c6943f3e0455a27bad178ed93fadeb1c
a7756930981261f94e828a6e4edd39c82dc2959cd0c03a8e65efd73cb8939cd2
ba833b2b6210b781718e625b632e46751ab28582a5f1e475c44a425b3409ee2a
21424c9386ed6c518f89ffd488b7d32e64c34d1c9162c5935db4bf29efb72e32
1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d

SH256 hash:

1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d

MD5 hash:

58f95551c34e55c2281e796fde42c140

SHA1 hash:

9cfe211ddd3881eafb3348c54b7b35561d8baea4

Link:

https://www.unpac.me/results/7997e90d-1746-45fe-9280-5b9fc0c70f4d/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1514eb1f1c1d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	pe_detect_tls_callbacks Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3244748/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3244750/

URLhaus

https://urlhaus.abuse.ch/url/3242963/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThreadpoolWork
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample