MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882
SHA3-384 hash: 43b8dde5698b3719d726574d5fc9d3c48ed812304519ad9651a57f6be3eb57bd1234b2eeacbac369ae929fedced1f245
SHA1 hash: 03ac191b235b3a867539720070a5e6ca1108b4f2
MD5 hash: 80c2a36e9a14e3edba0b706d2433d9b8
humanhash: grey-eight-beer-oven
File name:80c2a36e9a14e3edba0b706d2433d9b8.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'881'672 bytes
First seen:2024-09-27 09:04:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 03338d7801a2b5a198bb18f8db55defc (1 x LummaStealer)
ssdeep 49152:MBjwz++TjZgdXCs6xTqVRoITZE87wajH/Qc9d1OF:yoz37p805cVO
Threatray 1 similar samples on MalwareBazaar
TLSH T13FD5BF207AD2C17BF9623A71996E9A5F851CAE65072425CFD3C82F3B14B11D30F3B866
TrID 50.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
27.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.1% (.EXE) Win64 Executable (generic) (10523/12/4)
4.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon 22e0d88ef6d89902 (1 x LummaStealer)
Reporter abuse_ch
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
383
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PrivacyDrive.exe
Verdict:
Malicious activity
Analysis date:
2024-09-26 16:14:05 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/b9954290-4cbd-4426-bb38-ea27177bb7ff

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PWS.Lumma.451.19633.21104.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f6754e79032805ce8e5b58
Tags:
Encryption Static Dropper Exploit Tori
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto epmicrosoft_visual_cc explorer fingerprint greyware keylogger lolbin microsoft_visual_cc overlay packed shell32 whirlpool
Link:
https://www.filescan.io/uploads/66f675483b87ff03b25c3a57/reports/76f8c599-20d5-4118-a76b-5301d56f951a/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7c3dfd19-aebe-471c-b78c-d92303a3f99e
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1520450
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to infect the boot sector
Found malware configuration
LummaC encrypted strings found
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
68%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cvg24omelk7prcnpqff5nlmefazxjsioz3hisgw5ynrdqsx53cba._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/240927-k17ctaxfre/
Behaviour
Suspicious behavior: EnumeratesProcesses
Program crash
System Location Discovery: System Language Discovery
Lumma Stealer, LummaC
Malware Config
C2 Extraction:
https://defenddsouneuw.shop/api
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/05edd6f0-7838-425e-b375-59df211706ab
Unpacked files
SH256 hash:
2c023412790301a60119d30103d7406f98ad452e0ab99e9422d0d7ffd87270f0
MD5 hash:
2d044b17cbce5ecabadaa81265799c50
SHA1 hash:
c2930d7b490a9046a634b58417cbcf2fda820b35
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/9bedc287-d66c-4c38-9a4e-5e674a07ceb4/
Parent samples :
b0db2b04d77743f2d7df624e72088e57bbd72ac569bd9c503fe8fd544ecc651b
154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882
SH256 hash:
154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882
MD5 hash:
80c2a36e9a14e3edba0b706d2433d9b8
SHA1 hash:
03ac191b235b3a867539720070a5e6ca1108b4f2
Link:
https://www.unpac.me/results/9bedc287-d66c-4c38-9a4e-5e674a07ceb4/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/154dae39845a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RC6_Constants
Create hunting rule
Author:chort (@chort0)
Description:Look for RC6 magic constants in binary
Reference:https://twitter.com/mikko/status/417620511397400576
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::EqualSid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetSidSubAuthority
ADVAPI32.dll::GetSidSubAuthorityCount
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipDeleteGraphics
gdiplus.dll::GdipFillRectangleI
gdiplus.dll::GdipFillRectangle
gdiplus.dll::GdipDeleteBrush
RPC_APICan Execute Remote ProceduresRPCRT4.dll::RpcBindingFree
RPCRT4.dll::RpcBindingFromStringBindingW
RPCRT4.dll::RpcEpResolveBinding
RPCRT4.dll::RpcStringBindingComposeW
RPCRT4.dll::RpcStringFreeW
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::GetSidIdentifierAuthority
ADVAPI32.dll::GetTokenInformation
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetVolumeInformationW
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetFileAttributesW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupAccountNameW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptAcquireContextA
ADVAPI32.dll::CryptGenRandom
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegCreateKeyW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegOpenKeyW
ADVAPI32.dll::RegQueryValueExW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ChangeServiceConfig2W
ADVAPI32.dll::ControlService
ADVAPI32.dll::CreateServiceW
ADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::OpenServiceW
ADVAPI32.dll::QueryServiceStatus
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments