MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599
SHA3-384 hash: 081362dfbf339b4e3b1efa6faf714d601cd16fc85b570720397525fc14b01b34afe2d2130eb1ba020471c5b5653e07e3
SHA1 hash: 1bf6fca09a3252f2bf1a758425820f460cec83ec
MD5 hash: 415ff87e3c12c6f153a70608a31783a1
humanhash: happy-twelve-pip-xray
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:405'504 bytes
First seen:2024-04-17 19:39:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f7e025a73ffe1b8974f1e3a5c63f95ca (1 x LummaStealer, 1 x Stealc)
ssdeep 6144:cN3p9fBPl+VqAuUY6s5+IDpEBhknm8DYulcyNi:KXJPlxAuU/s5TWcmzyi
TLSH T14784BE2272E0A871F57347325E6DD6A4653EFD608F5A5B7B33486E1F04B20A0E632772
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 080818080e030600 (1 x LummaStealer)
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: https://world4flowers.shop/current.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
357
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599.exe
Verdict:
Malicious activity
Analysis date:
2024-04-17 19:42:29 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/2055d1a6-6c72-4bfb-babf-b24c85e7dbfb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e144d9da-007a-4659-9c3f-a3653ecef453
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1427620
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
LummaC encrypted strings found
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2024-04-17 19:40:06 UTC
File Type:
PE (Exe)
Extracted files:
29
AV detection:
21 of 24 (87.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fxynyu44kxjrdw735ecuf63j72vdkqvw36metswt6blga3rmgwmq._file
Verdict:
malicious
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma stealer
Link:
https://tria.ge/reports/240417-ydhylade3w/
Behaviour
Program crash
Lumma Stealer
Malware Config
C2 Extraction:
https://exceptionwillapews.shop/api
https://entitlementappwo.shop/api
https://economicscreateojsu.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://bordersoarmanusjuw.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api
Unpacked files
SH256 hash:
dcdf56d0939b1dc81d354f460de4b90f9b49bec8d933496128de7bcae7aec41f
MD5 hash:
37a7976151d112817a718a6ae1bf21b7
SHA1 hash:
22e0eab39d01761b527db2ef0c924bcd42b54ffa
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/4526eba5-2516-4aaf-8b44-c22d5fd67a9a/
SH256 hash:
2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599
MD5 hash:
415ff87e3c12c6f153a70608a31783a1
SHA1 hash:
1bf6fca09a3252f2bf1a758425820f460cec83ec
Link:
https://www.unpac.me/results/4526eba5-2516-4aaf-8b44-c22d5fd67a9a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2df0dc539c55/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:EXE_Stealer_StealC_Feb2024
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2815646/
  
URLhaus
https://urlhaus.abuse.ch/url/2799932/
  
URLhaus
https://urlhaus.abuse.ch/url/2797804/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetVolumeInformationW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AddConsoleAliasA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleInputA
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateHardLinkA
KERNEL32.dll::CreateFileW
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::RemoveDirectoryW
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpReadData

Comments