MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fcd09bbfac5cc99d930089a45b85e04e71dfa1cf75df14b14be18a7b68fabc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	2fcd09bbfac5cc99d930089a45b85e04e71dfa1cf75df14b14be18a7b68fabc4
SHA3-384 hash:	60217f33a6d0352659920edb1aa1cb625bdc5cc50bc2b0515b7b4a36c898ee6d1215c6feabe44f85fd5f984631a4d0ed
SHA1 hash:	01a662e1e8a00ff2fbe802d1d479ec6beb5d98b0
MD5 hash:	2fa5c9b3973341bb4ae72c895bd2a550
humanhash:	edward-tennis-aspen-fifteen
File name:	2fa5c9b3973341bb4ae72c895bd2a550.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	293'456 bytes
First seen:	2024-08-19 13:16:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'247 x AgentTesla, 20'516 x Formbook, 12'379 x SnakeKeylogger)
ssdeep	6144:wl2XyAhSC7y3mHYHgRRH8QJv7ZwbULt8iNOYlyOETEO:hXyyu3mGgHcilwbULttNF0OETEO
TLSH	T1A65412AE4AD80B69EEE7CD310182D457AE3CF2E57186EC5D553B0874FA0C3207A58761
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	abuse_ch
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

362

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2024-08-18 11:30:03 UTC

Tags:

stealer stealc loader

Link:

https://app.any.run/tasks/33fd6dd7-a1ba-4b5e-9421-771eebd572bf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packed.Stelpak-10034590-0

Win.Packed.Pwsx-10034591-0

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c345d0e7ff3f5a063b8a38

Tags:

Encryption Static Nekark

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/66c345d51136ce49230fff04/reports/34acfccd-57d8-469d-948c-265b09b3acbb/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/2fcd09bbfac5cc99d930089a45b85e04e71dfa1cf75df14b14be18a7b68fabc4

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/fd114779-616b-4249-9a4a-5b0240f3f024

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1494964

Signature

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking mutex)

Found malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

84%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2fcd09bbfac5cc99d930089a45b85e04e71dfa1cf75df14b14be18a7b68fabc4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2fcd09bbfac5cc99d930089a45b85e04e71dfa1cf75df14b14be18a7b68fabc4/

Threat name:

Win32.Spyware.Lummastealer

Status:

Malicious

First seen:

2024-08-17 23:40:31 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f7gqto72yxgjtwjqbcneloc6attr36q465o7csyuxymkpnupvpca._file

Verdict:

malicious

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/240819-qjcprsyhql/

Behaviour

Modifies system certificate store

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Malware Config

C2 Extraction:

https://drinnkysoapmzv.shop/api
https://potentioallykeos.shop/api
https://interactiedovspm.shop/api
https://charecteristicdxp.shop/api
https://cagedwifedsozm.shop/api
https://deicedosmzj.shop/api
https://southedhiscuso.shop/api
https://consciousourwi.shop/api
https://tenntysjuxmz.shop/api

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7c3e6fc4-1554-427b-b536-dfec8f2247a7

Unpacked files

SH256 hash:

c90f1cd50cc7a52e79c9d0989f5e367a672622bfc0d31f00fac215a2ace70650

MD5 hash:

3a8dbe06de2a9c1dc62f0b8d61d34069

SHA1 hash:

807ef305eb8c0426bdba48bd1ac7f9a83508bcff

Detections:

LummaStealer

Link:

https://www.unpac.me/results/5e729793-864c-4bfc-9a63-d3243fe0a716/

SH256 hash:

2fcd09bbfac5cc99d930089a45b85e04e71dfa1cf75df14b14be18a7b68fabc4

MD5 hash:

2fa5c9b3973341bb4ae72c895bd2a550

SHA1 hash:

01a662e1e8a00ff2fbe802d1d479ec6beb5d98b0

Link:

https://www.unpac.me/results/5e729793-864c-4bfc-9a63-d3243fe0a716/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2fcd09bbfac5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/2fcd09bbfac5cc99d930089a45b85e04e71dfa1cf75df14b14be18a7b68fabc4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample