MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6322983049c64fc34aeeeca8dfbd9084fef30c59422d6e482551e69c53ba2798. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6322983049c64fc34aeeeca8dfbd9084fef30c59422d6e482551e69c53ba2798
SHA3-384 hash: 7e816d8663fea5a798a01b57f337e428719286923480b859ce65c643bf7d37abd7c5e005af52a9ac4f2b6129d705da53
SHA1 hash: 993536f588687e55d5ea86fcd28dfd892f658fbf
MD5 hash: a4896888e5e3c98e4c34278d93b28b50
humanhash: vegan-music-bakerloo-hamper
File name:5.253.59.205
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'812'187 bytes
First seen:2025-01-27 07:22:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ebcdff4fe394a3e0cd90455a8a72ef29 (10 x Emmenhtal, 4 x LummaStealer)
ssdeep 49152:jV+9MjbgyfUWYTlw1nTcd1QDpV+9MjbgyfUWYTlw1nTcd1QDAV+9MjbgyfUWYTlb:BzQqzQHzQ/zQSzQ
TLSH T1D8D57E50AAAF07D6ECC638394BAE3A6F013E59260B64E6CBC6511D87F0B61D214315FF
TrID 51.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.2% (.EXE) Win64 Executable (generic) (10522/11/4)
10.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.3% (.EXE) Win32 Executable (generic) (4504/4/1)
3.3% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter JAMESWT_WT
Tags:5-253-59-205 booking exe LummaStealer Spam-ITA

Intelligence

File Origin
# of uploads :
1
# of downloads :
454
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
danabot
Create hunting rule
ID:
1
File name:
google.com
Verdict:
Malicious activity
Analysis date:
2025-01-22 13:57:38 UTC
Tags:
danabot stealer danabot-unpacked
Link:
https://app.any.run/tasks/3f3fd3b6-0a54-45a3-a4f6-cc0e69c7c932

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
ditekSHen.MALWARE.Win.Trojan.FakeCaptcha-Downloader.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/6322983049c64fc34aeeeca8dfbd9084fef30c59422d6e482551e69c53ba2798
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MustardSandwich
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d8a80610-149d-43b6-a0f1-55f348d86072
Result
Threat name:
Emmenhtal Loader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1600178
Signature
Malicious sample detected (through community Yara rule)
Yara detected Emmenhtal Loader
Behaviour
Behavior Graph:
Download SVG
Score:
5%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/6322983049c64fc34aeeeca8dfbd9084fef30c59422d6e482551e69c53ba2798
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6322983049c64fc34aeeeca8dfbd9084fef30c59422d6e482551e69c53ba2798/
Threat name:
Win32.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-01-23 09:18:10 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mmrjqmcjyzh4gsxo5sun7pmqqt7pgdcziiww4sbfkhtjyu52e6ma._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250127-h7srwsymdq/
Behaviour
Modifies registry class
System Location Discovery: System Language Discovery
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/797e80a7-2dea-47cd-9193-a51aa8e98327
Unpacked files
SH256 hash:
6322983049c64fc34aeeeca8dfbd9084fef30c59422d6e482551e69c53ba2798
MD5 hash:
a4896888e5e3c98e4c34278d93b28b50
SHA1 hash:
993536f588687e55d5ea86fcd28dfd892f658fbf
Detections:
Emmenhtal
Create hunting rule
Link:
https://www.unpac.me/results/2c62060e-a33f-47e1-944e-31d1ca781ff8/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:IDATDropper
Create hunting rule
Author:NDA0E
Description:Detects files containing embedded JavaScript; the JS executes a PowerShell command which either downloads IDATLoader in an archive, or an executable (not IDATLoader) which is loaded into memory. The modified PE will only run if it's executed as an HTML Application (.hta).
Rule name:MALWARE_Win_FakeCaptcha_Downloader
Create hunting rule
Author:ditekshen
Description:Detects downloader executables dropped by fake captcha
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 6322983049c64fc34aeeeca8dfbd9084fef30c59422d6e482551e69c53ba2798

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3415946/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
DP_APIUses DP APICRYPT32.dll::CryptProtectData
WIN32_PROCESS_APICan Create Process and Threadsapi-ms-win-core-handle-l1-1-0.dll::CloseHandle
WIN_BASE_APIUses Win Base APIapi-ms-win-core-processthreads-l1-1-0.dll::TerminateProcess
api-ms-win-core-libraryloader-l1-2-0.dll::LoadLibraryExA
api-ms-win-core-libraryloader-l1-2-0.dll::LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-1.dll::LoadLibraryW
api-ms-win-core-file-l1-1-0.dll::GetDriveTypeW
api-ms-win-core-file-l1-1-0.dll::GetVolumeInformationW
WIN_BASE_IO_APICan Create Filesapi-ms-win-core-file-l1-1-0.dll::CreateFileA
api-ms-win-core-file-l1-1-0.dll::CreateFileW
api-ms-win-core-file-l1-1-0.dll::DeleteFileW
api-ms-win-core-sysinfo-l1-1-0.dll::GetSystemDirectoryW
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CertVerifyCertificateChainPolicy
CRYPTSP.dll::CryptAcquireContextW
CRYPTSP.dll::CryptCreateHash
CRYPTSP.dll::CryptDeriveKey
CRYPTSP.dll::CryptExportKey
CRYPTSP.dll::CryptGenKey
WIN_REG_APICan Manipulate Windows Registryapi-ms-win-core-registry-l1-1-0.dll::RegCreateKeyExA
api-ms-win-core-registry-l1-1-0.dll::RegOpenKeyExA
api-ms-win-core-registry-l1-1-0.dll::RegSetValueExA
WIN_TRUST_APIUses Windows Trust APIWINTRUST.dll::WinVerifyTrust
WINTRUST.dll::WTHelperProvDataFromStateData

Comments