MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1969b7fd4dcce747f0e0b69febc6fec098ca8cd31bdfe2cfb1e2b2590df3e78c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
LummaStealer
Vendor detections: 13
| SHA256 hash: | 1969b7fd4dcce747f0e0b69febc6fec098ca8cd31bdfe2cfb1e2b2590df3e78c |
|---|---|
| SHA3-384 hash: | e44e07b22c46e6fb3cb716ae82175feded69c8bc8f5ab7bc1db4523724f64d96075c0b7a3ced016a3ddf035195bbf569 |
| SHA1 hash: | 6c85d4e799635885545300aba3deaa0e57110d77 |
| MD5 hash: | a1793f2b9fbe4c2c42068d28164d7053 |
| humanhash: | bulldog-colorado-two-crazy |
| File name: | CachemanTray_[1MB]_[unsign].exe |
| Download: | download sample |
| Signature | LummaStealer |
| File size: | 1'948'872 bytes |
| First seen: | 2024-10-09 11:27:08 UTC |
| Last seen: | 2024-10-09 12:29:44 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 9ea3bc7ed585b2b4c227ef520e8b7be5 (1 x LummaStealer) |
| ssdeep | 49152:0bFLSKDSjEZizVdXX3H33HCOr98s7bbzzTjVzPwmqB7:0xpCdXX3H33HCs7bbzzTjemqB7 |
| TLSH | T14E95AF12F3C28433E1B317749DABD3889B25BD102E78999737F89E4C9E7A6817C142D6 |
| TrID | 41.9% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 31.3% (.EXE) InstallShield setup (43053/19/16) 10.3% (.EXE) Win32 Executable Delphi generic (14182/79/4) 7.2% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2) 3.2% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | ae6e4e6c4e6e4ea6 (1 x LummaStealer) |
| Reporter |  likeastar20 |
| Tags: | exe lumma LummaC2 LummaStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
417
Origin country :
ROVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CachemanTray_[1MB]_[unsign].exe
Verdict:
Malicious activity
Analysis date:
2024-10-09 11:26:04 UTC
Tags:
stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Verdict:
Malicious
Score:
99.1%
Tags:
Dropper Stealer Exploit Emotet
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
borland_delphi control evasive explorer fingerprint invalid-signature keylogger lolbin overlay packed remote shell32 signed
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Verdict:
Suspicious
Result
Threat name:
LummaC
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
AI detected suspicious sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain checking for user administrative privileges
Found malware configuration
LummaC encrypted strings found
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Score:
97%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Generic
Status:
Malicious
First seen:
2024-10-08 23:58:21 UTC
File Type:
PE (Exe)
Extracted files:
79
AV detection:
11 of 24 (45.83%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
discovery
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
a6712d142239ae45747b1bd8d9b2123eb4867c8f0de3080a499f1605751ca19f
MD5 hash:
4ab89b5c8b311c9f6d665e07b6f1b4f8
SHA1 hash:
044346701d185f70db8f0f26a14ec9038732869d
Detections:
LummaStealer
SH256 hash:
bbb84fe5f20d343dc511bbde22f27cad92f42aadedd106a81a54538553c48272
MD5 hash:
58ab399730063540862e7a196813075e
SHA1 hash:
20452775c49d60ffec4758c7e687e99ddd33fb17
SH256 hash:
1969b7fd4dcce747f0e0b69febc6fec098ca8cd31bdfe2cfb1e2b2590df3e78c
MD5 hash:
a1793f2b9fbe4c2c42068d28164d7053
SHA1 hash:
6c85d4e799635885545300aba3deaa0e57110d77
Malware family:
Lumma
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lumma
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| Rule name: | Check_OutputDebugStringA_iat |
|---|
| Rule name: | Detect_Malicious_VBScript_Base64 |
|---|---|
| Author: | daniyyell |
| Description: | Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell. |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | PE_Potentially_Signed_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | advapi32.dll::InitializeSecurityDescriptor |
| COM_BASE_API | Can Download & Execute components | ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal |
| SECURITY_BASE_API | Uses Security Base API | advapi32.dll::SetSecurityDescriptorDacl |
| SHELL_API | Manipulates System Shell | shell32.dll::ShellExecuteA |
| WIN32_PROCESS_API | Can Create Process and Threads | kernel32.dll::OpenProcess kernel32.dll::VirtualAllocEx kernel32.dll::WriteProcessMemory kernel32.dll::CloseHandle kernel32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | ntdll.dll::NtQuerySystemInformation kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA |
| WIN_BASE_IO_API | Can Create Files | kernel32.dll::CreateFileMappingA kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA |
| WIN_BASE_USER_API | Retrieves Account Information | kernel32.dll::GetComputerNameA |
| WIN_REG_API | Can Manipulate Windows Registry | advapi32.dll::RegCreateKeyExA advapi32.dll::RegOpenKeyExA advapi32.dll::RegOpenKeyExW advapi32.dll::RegQueryValueExA advapi32.dll::RegQueryValueExW advapi32.dll::RegSetValueExA |
| WIN_SVC_API | Can Manipulate Windows Services | advapi32.dll::ControlService advapi32.dll::OpenSCManagerA advapi32.dll::OpenServiceA |
| WIN_USER_API | Performs GUI Actions | user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::EmptyClipboard user32.dll::FindWindowExA user32.dll::FindWindowA user32.dll::OpenClipboard |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.