MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 318b4327dcbdff36cb1b5bd2eaa1b08e6f3da93a136656cd301fd6967f790f9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	318b4327dcbdff36cb1b5bd2eaa1b08e6f3da93a136656cd301fd6967f790f9e
SHA3-384 hash:	5052f88b45f4a4a0de5f938cc2a6029bd72a1c4a49095caa53a30443e64236f445efd27a8a7495b8279da2929df0aa86
SHA1 hash:	501d8c7c6cb19f796bc8baa930b3080c1f9b817e
MD5 hash:	982688722d0d4e38978e9f1ea20e3a4e
humanhash:	lamp-connecticut-dakota-wisconsin
File name:	Midnight.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	34'393'095 bytes
First seen:	2023-11-17 14:26:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep	98304:8GSKnZsB74itf/DaLLqMt2PcH5Gb8nu8mO6SESBtLh7e1SHU5Je8t6H:8G/nZsV4cUHg8uUt7Lh7el5Je8t6H
TLSH	T1C7773396A3B1C465F88A92B0AD6F4F0A0578AC677934EDC88AD0FC4C7BF36E15406563
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	698e2b3d313b8e69 (2 x LummaStealer, 1 x RedLineStealer)
Reporter	Xev
Tags:	CoinMiner exe LummaStealer RisePro Stealc XMRIG

NIXLovesCooper

C2: http://goodmpore.pw/api
C2: http://135.181.11.36/api/endpoint.php

Intelligence

File Origin

# of uploads :

# of downloads :

396

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Sending a custom TCP request

Creating a process from a recently created file

Сreating synchronization primitives

Searching for the window

Launching a process

Running batch commands

Adding an exclusion to Microsoft Defender

Unauthorized injection to a system process

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

89%

Tags:

control installer lolbin overlay shell32

Link:

https://www.filescan.io/uploads/655778382a052d4666ce28c0/reports/199ff765-a341-4438-9140-62156cdea783/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/318b4327dcbdff36cb1b5bd2eaa1b08e6f3da93a136656cd301fd6967f790f9e

Result

Verdict:

MALICIOUS

Result

Threat name:

LummaC Stealer, Xmrig

Detection:

malicious

Classification:

troj.spyw.expl.evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1344153

Signature

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to behave differently if execute on a Russian/Kazak computer

Creates files in the system32 config directory

Drops large PE files

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sets debug register (to hijack the execution of another thread)

Sigma detected: Stop multiple services

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected LummaC Stealer

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

Win32.Trojan.TrickOrTreat

Status:

Malicious

First seen:

2023-11-17 14:27:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 22 (72.73%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ggfugj64xx7tnsy3lpjovinqrzxt3kj2cntfntjqd7ljm73zb6pa._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

10/10

Tags:

evasion spyware

Link:

https://tria.ge/reports/231117-rseq6aaa66/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Drops file in Program Files directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Executes dropped EXE

Loads dropped DLL

Stops running service(s)

Suspicious use of NtCreateUserProcessOtherParentProcess

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/318b4327dcbd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Stealc

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/318b4327dcbdff36cb1b5bd2eaa1b08e6f3da93a136656cd301fd6967f790f9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.