MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dc4d118baed1b3c0e43c1a9facb116da59dea3cf47a673bb67acc1468996633. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6dc4d118baed1b3c0e43c1a9facb116da59dea3cf47a673bb67acc1468996633
SHA3-384 hash:	4c7f2871b11038271c687baf5884d6b2836b13a5e8d8e8fa8bd44928e6d21c3718d67153d78ec3fad1dfeb217235f9b0
SHA1 hash:	8a79019c278e4570c0f1a5e874ff0a8b97f635d5
MD5 hash:	587d722b80c1fc42233cd1de80754093
humanhash:	bacon-item-eighteen-pizza
File name:	587D722B80C1FC42233CD1DE80754093.exe
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	523'776 bytes
First seen:	2023-12-15 17:15:19 UTC
Last seen:	2023-12-15 19:20:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	87276645a61980fa58d8085fc4df7bae (7 x LummaStealer)
ssdeep	12288:qPQGBv7/GreidR54w3W0tnuGi7a6K2ij2AN+er1i1xHK6wFuWpH+1OR:qPQGBv7Or5qwG0tn5Wa6jANBS9K62Bl
TLSH	T192B48CC07B4250BAC4925C350425A7BA2E740F615329DCFFC21768E1F7B9E7B927292B
TrID	42.7% (.EXE) Win32 Executable (generic) (4505/5/1) 19.2% (.EXE) OS/2 Executable (generic) (2029/13) 19.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.9% (.EXE) DOS Executable Generic (2000/1)
Reporter	abuse_ch
Tags:	exe LummaStealer

abuse_ch

LummaStealer C2:
http://godlawyerfeelkw.fun/api

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

318

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/467626/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.23509.28733.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Dragonfly

Gathering data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

crypto greyware lumma

Link:

https://www.filescan.io/uploads/657c89d3b290743934e5e05b/reports/f579a5f6-d46c-441a-8aaf-a615817b03a3/overview

Hybrid Analysis Jaik.Generic

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/6dc4d118baed1b3c0e43c1a9facb116da59dea3cf47a673bb67acc1468996633

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2f2ed052-34c3-4e8d-b64f-ee364daaf440

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1362831

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking computer name)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/6dc4d118baed1b3c0e43c1a9facb116da59dea3cf47a673bb67acc1468996633

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6dc4d118baed1b3c0e43c1a9facb116da59dea3cf47a673bb67acc1468996633/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-12-12 16:36:54 UTC

File Type:

PE (Exe)

AV detection:

24 of 37 (64.86%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nxcncgf25untydsdygu7vsyrnwsz32r46r5goo5wplgbi2ezmyzq._file

Threatray malicious

Verdict:

malicious

Hatching Triage lumma

Result

Malware family:

lumma

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma

Link:

https://tria.ge/reports/231215-vs48lahgg5/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

UnpacMe win_lumma_a0

Unpacked files

SH256 hash:

6dc4d118baed1b3c0e43c1a9facb116da59dea3cf47a673bb67acc1468996633

MD5 hash:

587d722b80c1fc42233cd1de80754093

SHA1 hash:

8a79019c278e4570c0f1a5e874ff0a8b97f635d5

Detections:

win_lumma_a0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/b45706c7-5644-4596-9c69-97897e80911d/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6dc4d118baed1b3c0e43c1a9facb116da59dea3cf47a673bb67acc1468996633

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/467626/