🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 707bdb3e5cb4c226d6502629f9159a585d6eed0fe4d0bdc66bab4d9490d6559b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 707bdb3e5cb4c226d6502629f9159a585d6eed0fe4d0bdc66bab4d9490d6559b
SHA3-384 hash: e1115d41bf905ac64b1786fba5dff7509d7a7b45a9b2649e54e6f71f6230743832bb8a2afb270937ff930c25aa4cd07d
SHA1 hash: 77a8fc10cabb3db178db9b168e88b5e49c17be2f
MD5 hash: e46882581dd5c198b7b48152ed80ae59
humanhash: twelve-oregon-north-monkey
File name:707bdb3e5cb4c226d6502629f9159a585d6eed0fe4d0bdc66bab4d9490d6559b
Download: download sample
Signature LummaStealer
Create hunting rule
File size:6'655'320 bytes
First seen:2023-09-15 10:03:10 UTC
Last seen:2023-09-15 10:36:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c7269d59926fa4252270f407e4dab043 (46 x Hive, 23 x ServHelper, 22 x CobaltStrike)
ssdeep 49152:XMVRoZKnr3J1cPrb/TevO90dL3BmAFd4A64nsfJHtP49XcLWW9rXKDA1dskDnlrq:XMq83PAtghOJH12kgS7qGpofC5E+g
Threatray 37 similar samples on MalwareBazaar
TLSH T145663A43F85541F8C1ADD130CB65C2A2BA717C88473023D7AB50FBB62B72BD46A79B64
gimphash 58ac455122bdff9013ae441046ea64a87fc6d873d5bae2ddb73565f5daa055ca
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon d4c4c4d8ccd4f0cc (245 x AgentTesla, 65 x Loki, 42 x Formbook)
Reporter crep1x
Tags:exe lumma LummaStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
349
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
707bdb3e5cb4c226d6502629f9159a585d6eed0fe4d0bdc66bab4d9490d6559b
Verdict:
Malicious activity
Analysis date:
2023-09-15 10:05:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f0f7402a-32ae-42dc-bd1e-8cde126f5bf8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448805/
Detection(s):
SecuriteInfo.com.Trojan.Win64.Penguish.MTB.403.16271.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expand golang greyware lolbin overlay packed
Link:
https://www.filescan.io/uploads/65042c1325e2ece4df6f1645/reports/f3979cbe-7f40-4dde-9594-81ad5e9a47a5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/707bdb3e5cb4c226d6502629f9159a585d6eed0fe4d0bdc66bab4d9490d6559b
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ff633306-6f80-42d6-9f6f-71d5ff03e9d8
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1308862
Signature
Antivirus detection for dropped file
Found hidden mapped module (file has been removed from disk)
Found many strings related to Crypto-Wallets (likely being stolen)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1308862 Sample: 9UFajRKG12.exe Startdate: 15/09/2023 Architecture: WINDOWS Score: 100 39 Antivirus detection for dropped file 2->39 41 Multi AV Scanner detection for dropped file 2->41 43 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->43 45 4 other signatures 2->45 7 9UFajRKG12.exe 4 2->7         started        process3 dnsIp4 25 i.ibb.co 104.243.38.202, 443, 49719 RELIABLESITEUS United States 7->25 27 archive.org 207.241.224.2, 443, 49718 INTERNET-ARCHIVEUS United States 7->27 47 Writes to foreign memory regions 7->47 49 Maps a DLL or memory area into another process 7->49 11 more.com 3 7->11         started        signatures5 process6 file7 21 C:\Users\user\AppData\Local\Temp\njmwddv, PE32 11->21 dropped 23 C:\Users\user\...\WMIRegistrationService.exe, PE32 11->23 dropped 51 Found hidden mapped module (file has been removed from disk) 11->51 53 Maps a DLL or memory area into another process 11->53 55 Sample uses process hollowing technique 11->55 15 WMIRegistrationService.exe 12 11->15         started        19 conhost.exe 11->19         started        signatures8 process9 dnsIp10 29 fartyfun.fun 104.21.73.242, 49724, 49725, 49727 CLOUDFLARENETUS United States 15->29 31 172.67.193.118, 49726, 49729, 49730 CLOUDFLARENETUS United States 15->31 33 Query firmware table information (likely to detect VMs) 15->33 35 Found many strings related to Crypto-Wallets (likely being stolen) 15->35 37 Tries to harvest and steal browser information (history, passwords, etc) 15->37 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/707bdb3e5cb4c226d6502629f9159a585d6eed0fe4d0bdc66bab4d9490d6559b/
Threat name:
Win64.Trojan.Penguish
Create hunting rule
Status:
Malicious
First seen:
2023-09-14 17:46:21 UTC
File Type:
PE+ (Exe)
Extracted files:
35
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ob55wps4wtbcnvsqeyu7sfm2lbow53ip4til3rtlvngzjegwkwnq._file
Verdict:
unknown
Similar samples:
08d8bd49d5248a1ceca14cd69f327f6685dbc44887aab5a14eb79c71baa123c1
LummaStealer
32579835a3ab3be52dc80ea4a37701c4294ddfb121f84d4ace8bcf3299c1d29c
LummaStealer
3fbedfb9ae1e9bcef7983491124e3a50937f9c5209b7cfc2614197a2e8045cfb
LummaStealer
554990b8636baf5af393d52ce85150a8b263b9c5fb214bc0e69a1b032ee8f3ae
LummaStealer
5af315bcc30acd6cc73fcd53f6d50be474008aee4f491cb844892752e9fc860d
LummaStealer
5ed4dfb7da504438688d779092a717cb2426ee88bc4f0ee588b3e989b7567dff
LummaStealer
76e4962b8ccd2e6fd6972d9c3264ccb6738ddb16066588dfcb223222aaa88f3c
LummaStealer
7aa4903001e55982d11c76c178d9006aaaf137c5a941067cc6bf1b91edde62a1
LummaStealer
b5925854d8595749fe5576249ccdcf3d8badc77b88c98ab966235e765a674b22
LummaStealer
+ 27 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230915-l3yzwshh9w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
707bdb3e5cb4c226d6502629f9159a585d6eed0fe4d0bdc66bab4d9490d6559b
MD5 hash:
e46882581dd5c198b7b48152ed80ae59
SHA1 hash:
77a8fc10cabb3db178db9b168e88b5e49c17be2f
Link:
https://www.unpac.me/results/7b502aad-c1da-4655-8531-9f3aa0bbf9d6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/707bdb3e5cb4c226d6502629f9159a585d6eed0fe4d0bdc66bab4d9490d6559b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/crep1x/status/1702620376872657321
Cape
Cape
https://www.capesandbox.com/analysis/448805/

Comments