MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fb3cc15e800f3707f42e3d7484177b617c2548f161141efea3d722090f77add. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments

SHA256 hash:	3fb3cc15e800f3707f42e3d7484177b617c2548f161141efea3d722090f77add
SHA3-384 hash:	23a33dcc685c5fa243a2ac979a593a0e2a40fd0c8ea58cd2b2ae06013db9495a3dd3d857582a18d8b80cbbaa99e95d65
SHA1 hash:	12c32cd83c858d1779014b3d3fcaa41ffaee1ec0
MD5 hash:	d8c64a1a21a3dc7d3cc719de3ca90bb3
humanhash:	emma-september-oregon-finch
File name:	NеwInst.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	284'200 bytes
First seen:	2024-08-19 17:16:02 UTC
Last seen:	2024-08-19 18:27:00 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'294 x AgentTesla, 20'712 x Formbook, 12'401 x SnakeKeylogger)
ssdeep	6144:OPGu1Ih10s4WLRm9mbDnFwDaFDN7xtXN/KS/j/y7KEO:O5q10bW5bDn6DEKSLy+EO
TLSH	T1AE5423B617E08434EF6F99B5CAA6D710CFF07A6125CF7EAF08279E491B967201F050A1
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	aachum
Tags:	exe LummaStealer

iamaachum

YouTube Video => https://www.mediafire.com/folder/jry5ohhe8laa5/roblox_v2 => https://www.mediafire.com/file/roiurx8986634yj/N%25D0%25B5w.zip/file

Lumma C2:
https://torubleeodsmzo.shop/api
https://potentioallykeos.shop/api
https://interactiedovspm.shop/api
https://charecteristicdxp.shop/api
https://cagedwifedsozm.shop/api
https://deicedosmzj.shop/api
https://southedhiscuso.shop/api
https://consciousourwi.shop/api
https://tenntysjuxmz.shop/api

Intelligence

File Origin

# of uploads :

# of downloads :

378

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

NеwInst.exe

Verdict:

Malicious activity

Analysis date:

2024-08-19 17:18:32 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/e5b5aa84-72e3-4d04-959c-4a3b6f1ef52c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.31190.29456.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c37dd4b2a4681a7296578a

Tags:

Encryption Static Nekark

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/3fb3cc15e800f3707f42e3d7484177b617c2548f161141efea3d722090f77add

Malware family:

LummaC2 Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/04f31300-e375-4acd-b845-b201629e2af3

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1495181

Signature

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking mutex)

Found malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

93%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3fb3cc15e800f3707f42e3d7484177b617c2548f161141efea3d722090f77add

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3fb3cc15e800f3707f42e3d7484177b617c2548f161141efea3d722090f77add/

Threat name:

ByteCode-MSIL.Spyware.Lummastealer

Status:

Malicious

First seen:

2024-08-19 13:00:36 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h6z4yfpiadzxa72c4pluqqlxwyl4evepcyiud37khvzcbehxploq._file

Verdict:

malicious

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/240819-vs48lazfkm/

Behaviour

Modifies system certificate store

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Malware Config

C2 Extraction:

https://torubleeodsmzo.shop/api
https://potentioallykeos.shop/api
https://interactiedovspm.shop/api
https://charecteristicdxp.shop/api
https://cagedwifedsozm.shop/api
https://deicedosmzj.shop/api
https://southedhiscuso.shop/api
https://consciousourwi.shop/api
https://tenntysjuxmz.shop/api

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5b7ad0d5-1d45-4c18-916a-f487251e56bb

Unpacked files

SH256 hash:

75f4475f604476f1411e8ae593c0569e4a26b33a27bf6abcd18fac2f54d03299

MD5 hash:

cf76ae17301cdab6c242656006592a0c

SHA1 hash:

7d586352e7dee448af91d7785a578ff8ce6a98a3

Detections:

LummaStealer

Link:

https://www.unpac.me/results/4a7809a1-f13d-430f-9141-a400a0b284f8/

SH256 hash:

3fb3cc15e800f3707f42e3d7484177b617c2548f161141efea3d722090f77add

MD5 hash:

d8c64a1a21a3dc7d3cc719de3ca90bb3

SHA1 hash:

12c32cd83c858d1779014b3d3fcaa41ffaee1ec0

Link:

https://www.unpac.me/results/4a7809a1-f13d-430f-9141-a400a0b284f8/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3fb3cc15e800/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3fb3cc15e800f3707f42e3d7484177b617c2548f161141efea3d722090f77add

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 3fb3cc15e800f3707f42e3d7484177b617c2548f161141efea3d722090f77add

(this sample)

Link

https://tria.ge/240819-t338lsyclk

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample