MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28af030636fb2de633c6e85d7e15546fa99c09f40637d38aef2cb28a7957c1e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments 1

SHA256 hash:	28af030636fb2de633c6e85d7e15546fa99c09f40637d38aef2cb28a7957c1e2
SHA3-384 hash:	62a264220d64a7a666bbd26c2bfef0d29334cd140e4bfd369ee635f4b9960e1facde671b70501b28995bb4b7dd7bcfcd
SHA1 hash:	678b4c344811655f8f895c761023f3e5b010ea60
MD5 hash:	afb50a605a0becba370f6af59f51ab4e
humanhash:	mars-bacon-nuts-winner
File name:	afb50a605a0becba370f6af59f51ab4e
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	403'968 bytes
First seen:	2023-07-19 05:12:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	98aa9f2bca577016f4c3c962f5698e77 (1 x LummaStealer)
ssdeep	12288:z4nR3kPIypkuFRjZBBVZg748xZBdff1fQol:zcL4d3BVPiBdlfN
Threatray	25 similar samples on MalwareBazaar
TLSH	T17384BE11B9C2C0F2C86315310DE4E6BB9F397A30DA61CDCBFBD40C798A366C1A65665E
TrID	42.7% (.EXE) Win32 Executable (generic) (4505/5/1) 19.2% (.EXE) OS/2 Executable (generic) (2029/13) 19.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.9% (.EXE) DOS Executable Generic (2000/1)
Reporter	zbetcheckin
Tags:	32 exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

315

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

afb50a605a0becba370f6af59f51ab4e

Verdict:

Malicious activity

Analysis date:

2023-07-19 05:14:38 UTC

Tags:

lumma

Link:

https://app.any.run/tasks/eb859c94-c97e-4db3-a2e1-b6a6f3655cb4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/424446/

Detection(s):

SecuriteInfo.com.Variant.Babar.214949.8962.22830.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

cmd crypto greyware lolbin

Link:

https://www.filescan.io/uploads/64b770dff3c193545ac6c294/reports/d4d16174-20e5-42d4-9508-6267cc5ba7e6/overview

Verdict:

Malicious

Labled as:

Babar.Generic

Link:

https://www.hybrid-analysis.com/sample/28af030636fb2de633c6e85d7e15546fa99c09f40637d38aef2cb28a7957c1e2

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b092cacc-4f3f-487e-b1b1-e8fc6687ae3f

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1275637

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/28af030636fb2de633c6e85d7e15546fa99c09f40637d38aef2cb28a7957c1e2/

Threat name:

Win32.Trojan.Amadey

Status:

Suspicious

First seen:

2023-07-19 03:34:30 UTC

File Type:

PE (Exe)

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fcxqgbrw7mw6mm6g5box4fkun6uzycpuay35hcxpfsziu6kxyhra._file

Verdict:

malicious

LummaStealer

3dff203bab1db4bd7012e5daa23e467f7919587e5a306e497edb85caa2497dbe

LummaStealer

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204

LummaStealer

5c1b4a85647e4f359013fe9edb84bb6d6676ae473472e7951341075928214ef9

LummaStealer

7e7f09ae12feb0fe6e06fa095f5842fc5c11270bc08bec3ed05d87564890fcbc

LummaStealer

8e35c485f5a7bc19bdf66ad951c2d05de5cc72cc70ecc0a60e86b31028de8db9

LummaStealer

b9c2fa6207cd6e32d74e20820e6a62bbb618cf84e7fb74e95a5e7400ec88ffc1

LummaStealer

bb90c8c39ba60347b2d5f2a73a11f9c1f9f7e16251ca3098e4c087257bcce09b

LummaStealer

bcd079ed77301cc5f6a0443ccb3c5b4fe4a4b660ad61d5bcc40f0224c8c2da63

LummaStealer

df0de6f581fff0ddc9972190887715c30433bc08f4fdd3fbbe7cbfc0a0f9af9a

LummaStealer

+ 15 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/230719-fwed1sfh59/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

28af030636fb2de633c6e85d7e15546fa99c09f40637d38aef2cb28a7957c1e2

MD5 hash:

afb50a605a0becba370f6af59f51ab4e

SHA1 hash:

678b4c344811655f8f895c761023f3e5b010ea60

Link:

https://www.unpac.me/results/58a02ebc-ba4c-4ba0-86e9-1b5730abd67d/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/28af030636fb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/28af030636fb2de633c6e85d7e15546fa99c09f40637d38aef2cb28a7957c1e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	INDICATOR_SUSPICIOUS_USNDeleteJournal Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing anti-forensic artifcats of deletiing USN change journal. Observed in ransomware