MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ecc70dba52b81e7668f938d59f916a8ed4a0b8604b6a0278c39a4275d3d45d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4ecc70dba52b81e7668f938d59f916a8ed4a0b8604b6a0278c39a4275d3d45d7
SHA3-384 hash:	e1f4ddfbd9412ecd5838dc7e9e0106af56f0c4551a0c503599b6114d5f4fbe9dfa43fbf10d7492ebe2b408f270843eae
SHA1 hash:	b4af5f7ff775e1b886a2e91a8176a230d4d75572
MD5 hash:	21d07e51cece5ec8d6da1280e3002d07
humanhash:	september-utah-carbon-shade
File name:	Vortex Loader.bat
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	7'004 bytes
First seen:	2025-02-13 07:14:19 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	192:slTunmn882limVgaduii2onnpiPki1kiikitCn9CnnNniAT/8Ykl+l2limulZSlZ:slTunmn882limVgaduii2onnpiPki1kc
Threatray	2 similar samples on MalwareBazaar
TLSH	T129E1A6AAADA3F23422A94CFEDD2DF86467373318465851733AA4B93D050F3C78964D38
Magika	txt
Reporter	JAMESWT_WT
Tags:	147-45-44-42 bat booking LummaStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

117

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Vortex Loader.bat

Verdict:

Malicious activity

Analysis date:

2025-02-13 07:17:01 UTC

Tags:

loader lumma stealer auto

Link:

https://app.any.run/tasks/cb2309f2-addd-4334-a909-d4a5f60ec196

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ad9c0aa0fd713c335aa798

Tags:

obfuscate shell sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

evasive powershell

Link:

https://www.filescan.io/uploads/67ad9c04991985e0a957ff3b/reports/168ce6c6-ae01-412a-bb9f-7cb01f14a661/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4ecc70dba52b81e7668f938d59f916a8ed4a0b8604b6a0278c39a4275d3d45d7

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1614039

Signature

.NET source code contains very large strings

.NET source code references suspicious native API functions

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Compiles code for process injection (via .Net compiler)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Silenttrinity Stager Msbuild Activity

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

7%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/4ecc70dba52b81e7668f938d59f916a8ed4a0b8604b6a0278c39a4275d3d45d7

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ecc70dba52b81e7668f938d59f916a8ed4a0b8604b6a0278c39a4275d3d45d7/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j3ghbw5ffoa6ozupsogvt6iwvdwuuc4gas3kaj4mhgscoxj5ixlq._file

Threatray lummastealer

Verdict:

malicious

Label(s):

lummastealer

Alert

Create hunting rule

Similar samples:

ddade82f3abd31ce1bda5127f96bb658dd9eb8b48834552bc9daabc603acbba6

LummaStealer

error

LummaStealer

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250213-h294zsvrft/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Downloads MZ/PE file

Malware Config

Dropper Extraction:

http://147.45.44.42/boom/trcgfj.exe

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4ecc70dba52b81e7668f938d59f916a8ed4a0b8604b6a0278c39a4275d3d45d7