MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da
SHA3-384 hash:	c54ebc44e0247aa7e134ae1d324cbeb16d8640310a965c7992cda0660b9068fab15213926375a843f949b9294cebd02e
SHA1 hash:	98d8b2509628ab131345992f2d43241913d12557
MD5 hash:	5697159735d484d2d4fff3ef06aa6f62
humanhash:	north-rugby-table-august
File name:	re5.mp4
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	540'101 bytes
First seen:	2024-12-31 08:16:05 UTC
Last seen:	Never
File type:	hta
MIME type:	application/octet-stream
ssdeep	6144:dKqpsbLbkARe7CepXY5eUfdemme0629ecUT5sgIqevBReYbC:HQsu
Threatray	2'448 similar samples on MalwareBazaar
TLSH	T10AB4B0465A730614D87DC974EEDBCA282071BDC84C0587AE4ACDB43530AB5B87ED6AFC
Magika	zip
Reporter	lontze7
Tags:	hta LummaStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

89

Origin country :

FR

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6773aa2374a2bd296e24b6a5

Tags:

obfuscate xtreme mirai shell

DocGuard Clean

Result

Verdict:

Clean

File Type:

HTA File

Link:

https://app.docguard.net/3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da/results/dashboard

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6773a87f24c66757ceb6c7e9/reports/827adede-be0a-4f3b-96f3-beeea1c4bf3c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox LummaC

Result

Threat name:

LummaC

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1582681

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Malicious sample detected (through community Yara rule)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Download and Execute IEX

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Sigma detected: Suspicious PowerShell Parameter Substring

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Costura Assembly Loader

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da/

ReversingLabs TitaniumCloud Binary.Trojan.Generic

Threat name:

Binary.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-12-29 17:55:51 UTC

File Type:

Binary

AV detection:

4 of 23 (17.39%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gcmktrik7tkhrq7oxgyswn4uccoa6nssey54v6fqa56ecmmi4tna._file

Threatray lummastealer

Verdict:

malicious

Label(s):

lummastealer

Alert

Create hunting rule

Similar samples:

1fb9f279263c252a09f12b69c7238c18d2325f7cf7250ebe24ad9149abe62cf4

LummaStealer

424fbe09e0b7cb5600027b7469330a2809957bdbda04cf34e51dce3edcf9eb18

LummaStealer

7d99d26ac33c17b7038ae35b3bcf82f416bf8676e485603a043fe6272872b254

LummaStealer

8abb86b3dd80c4d37387eb28a3c96efc7c0ef1675337aeb8e5599e8e3140ee66

LummaStealer

a08e7d5f23bd08b42488c2e37110a1d2cc9339c41f7d7567ae95bdd469c01b9e

LummaStealer

error

LummaStealer

f34ab3c978462c0d763304689c493c9ebb1da5fc6a5aeac13c1a81cb5080a9e6

LummaStealer

+ 2'438 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery execution

Link:

https://tria.ge/reports/241231-kapp3stqeq/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da