MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3345e6b86cbd19266e4623cd90027639e389f1bd0043c96b6991efc31bcc9f5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 17


Intelligence 17 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3345e6b86cbd19266e4623cd90027639e389f1bd0043c96b6991efc31bcc9f5d
SHA3-384 hash: 509603981be538659a80ec26767edfb101f8cb4a923fc9d40d7843b05e317bcf9119a87157af121eb17662530c0a0591
SHA1 hash: 1a4fa9fe72a59bdad86e55cb4188462e3eaf4b97
MD5 hash: 47ade2d5d8c130d4264868f27cf0018d
humanhash: single-bulldog-sink-september
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'994'176 bytes
First seen:2024-10-24 18:18:53 UTC
Last seen:2024-10-24 19:17:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:s6V2vNzLKbCfX+VO7uvV6q3hj0bnNJQLLQ+2gGXueN+zRdy8PXkRhsgNqZ:T2vN3KbCWO7TEEnT81BON
Threatray 47 similar samples on MalwareBazaar
TLSH T1A0D55DA2B509B1CFD48AE7F89977CD425D1D03B6872048E3D86C65BA7EE3CCA11B5C24
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: http://185.215.113.16/luma/random.exe

Intelligence

File Origin
# of uploads :
22
# of downloads :
425
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-10-24 18:20:56 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/39fb5170-d60c-4f74-9338-fa5d9aee4ae8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.10318.29840.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=671a8f98890cf5f0e88cac81
Tags:
Malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Behavior that indicates a threat
DNS request
Connection attempt
Sending a custom TCP request
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed packer_detected
Link:
https://www.filescan.io/uploads/671a8f96d13ed5948b4d2dad/reports/732bffdb-32dd-47d9-86dd-137575210899/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/3345e6b86cbd19266e4623cd90027639e389f1bd0043c96b6991efc31bcc9f5d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/70613f68-c3c8-46e6-87ef-bc0e2b1b2f8b
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1541420
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3345e6b86cbd19266e4623cd90027639e389f1bd0043c96b6991efc31bcc9f5d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3345e6b86cbd19266e4623cd90027639e389f1bd0043c96b6991efc31bcc9f5d/
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2024-10-24 18:19:08 UTC
File Type:
PE (Exe)
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gnc6nodmxumsm3sgepgzaatwhhryt4n5abb4s23jshx4gg6mt5oq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
16b605fa7cc2aa50098424ad46909e96d831f244d05db0429dd856d27743967f
LummaStealer
178d3d7cf8356fb072de8ab0a493481c30c9f4b7559cec3f439a55a4135aee24
LummaStealer
474f1a30307ad485850abf5f66db96c90f84d3f745c3b70130ec509be36af4be
LummaStealer
661f5462bc608b50cdfc5049e7d0b2820aa3e55655a15adf71870a69d54d7789
LummaStealer
69f34af8c5469523637481e6932c9bbd3323f42952417d37c889989e2e654204
LummaStealer
7d4dfbfde23342f34cf4325a025784342236d4444f2417c181f063820f41f7b8
LummaStealer
c86df8b5b6844a8cf1048abb8985f2407cdad39105135f7f49e164dc23575188
LummaStealer
d5a65f6cb3df8185ead2ee7e6896813eee1556d70c01f2300e4b926944cd1530
LummaStealer
error
LummaStealer
f1746751074b85d0336d6ce8969da1e56cff65fe3c78f1d2215f4bf704729e29
LummaStealer
+ 37 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery evasion stealer
Link:
https://tria.ge/reports/241024-wyj1aazgjj/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Malware Config
C2 Extraction:
https://clearancek.site
https://licendfilteo.site
https://spirittunek.store
https://bathdoomgaz.store
https://studennotediw.store
https://dissapoiznw.store
https://eaglepawnoy.store
https://mobbipenju.store
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c97562b4-0d5e-4c92-bcc9-a3fd15b90e19
Unpacked files
SH256 hash:
f982b506132841ac67c79b89d3b5acf07ea965b3e738fa6fc772ee2b8eaddf1b
MD5 hash:
b5c3be4b119768e5ecb1d660ad995868
SHA1 hash:
fa90c6eaa8430ca081cfeeaf0b8d0e87450eaad0
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/847c5380-e4bb-4e66-9c26-bd8b78d12b0b/
SH256 hash:
3345e6b86cbd19266e4623cd90027639e389f1bd0043c96b6991efc31bcc9f5d
MD5 hash:
47ade2d5d8c130d4264868f27cf0018d
SHA1 hash:
1a4fa9fe72a59bdad86e55cb4188462e3eaf4b97
Link:
https://www.unpac.me/results/847c5380-e4bb-4e66-9c26-bd8b78d12b0b/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3345e6b86cbd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3345e6b86cbd19266e4623cd90027639e389f1bd0043c96b6991efc31bcc9f5d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 3345e6b86cbd19266e4623cd90027639e389f1bd0043c96b6991efc31bcc9f5d

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3245480/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments