MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 5 File information Comments

SHA256 hash:	7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30
SHA3-384 hash:	5234c7e8b44bbdb52e395a88cf887372bc82e242eeca1208b4b42eb6c07977d7887da2d45a43d91a88bd0559afbd3030
SHA1 hash:	4e24cbf53f526f1f8ffdd64697391038920c059a
MD5 hash:	06ed1519624124d6681bfa91211b96b2
humanhash:	timing-eighteen-maine-pennsylvania
File name:	06ed1519624124d6681bfa91211b96b2.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	287'232 bytes
First seen:	2024-08-30 07:37:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	6144:QnflxfTRyUw7/9DyVme/g80KDDX6TfEHHWVqyPT9zd/T6hyZ+WI:Mlxe/9DymeVuT6Wsyrtd/+hF
Threatray	109 similar samples on MalwareBazaar
TLSH	T10D542357EAF600D0D9791875A4A43AD6D11E7BAE0A7F4A7E146CC673BCE5F0CB20824C
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

353

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

06ed1519624124d6681bfa91211b96b2.exe

Verdict:

Malicious activity

Analysis date:

2024-08-30 07:52:05 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/2246bfdf-b105-46eb-bbef-48f9553f6446

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packed.Pwsx-10035189-0

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66d176dbf1a57bfb70915eab

Tags:

Static Nekark

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a file

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt to an infection source

Using the Windows Management Instrumentation requests

Query of malicious DNS domain

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/66d176e25959a837dd12baea/reports/6a51e97f-63d2-4af5-b919-d4d11b9f3e15/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/79a2e540-7dd1-4638-8eba-5975fab80cf7

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1501661

Signature

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30/

Threat name:

Win32.Trojan.LummaStealer

Status:

Malicious

First seen:

2024-08-29 06:42:52 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=piuhm2dgiz2prepx5rfvu3wsdnwzmz3f6iqz4nim2cgn4sef3uya._file

Verdict:

malicious

LummaStealer

24c26059e1855f17af7fc470d2a6ca8faa69ba6ca5b6526383f464d63845db4a

LummaStealer

7935b5b0a3c2fe6391fad0065809fbdd361af8a34fce890182a63a312f1703ef

LummaStealer

9744124ecb0bf5965384c19407753b1068551c2fe4f15a104b11f03ec1737626

LummaStealer

9e78165a00e2e7e9e5f81431bc43d5f254dd296e6c0629558f71ccabb5388a92

LummaStealer

d2e92610c10d49668db81f99c7fe97fb5d3a3c0b6eddf40b72041cc58526ebcf

LummaStealer

+ 99 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/240830-jgdeysthnq/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/169de5ee-d85c-4190-987f-5f1a013e9054

Unpacked files

SH256 hash:

04f4181559c1cc076ba4bb46e4a61555ecb36c13c53f65cd8436c16c378e2cb1

MD5 hash:

039b148822075141df8f0b8210a209cc

SHA1 hash:

a262c2519b69a30ac3f8fc629fc8439d94c49a0e

Detections:

LummaStealer

Link:

https://www.unpac.me/results/b8926600-3ee0-4749-b5ce-f7e780b347c1/

Parent samples :

7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30
2fbbabcf4baf488e361a0263093a2906a9c61c0ea1bb1cfeabf6b40088dae518
4fca8b07957c70ffa03c866c940be9483ecff646c50317f2c0d35c81889d3a24
49569bd796b2b66437013b9d7bd15145a8eb1375e94a115ffc3177403e367b65
970696ff4f5702283f22622e20bec65fc84776c663fc83760909f83530c0ebc2
d6795d2e532e35b95a787ab55cae096d94583c1f0daaaf20855a85e38992d4ca
cc2efb5a6286389b55a2612cf2b0d59135dc0b687b7ca3b74ea8ab1180944179
50f62cfb1967a288c742e21136eea5c2479a1a8dab3f133076b28d08e47d9813
eebb31044f8916d113549aeb003496d9893296b788935395f0dd154c4ab5d320
4c1e089208f7c0fc9b615093e26978bd52df0683a0c7b56859fa2612894f0b50
3f84c4383f10c49ea94cb7bbc645f1aca9bf1f61d8ef6034d8088ebed952436c
aba95993c5396861a8df3d90b3f81a69fde91746cc3c2fdc68b4a001c15bed05
e5d1e21b7a516b13c8ee17b2a42844a622cb24a459ba7289fe2306edb94da9ad
b2f33ee2da73268f2d327de9427f6583415fcb38fe7226325304aced5c243e9e
7b0a974cca2f956fbba6b61dfbed3de9d7f9020748db70b1d4077b3eab55fc50
dacd92502131ba666b4651f1092d9b4941e2d4a675d458f4a2f04b8a5e557a04

SH256 hash:

7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30

MD5 hash:

06ed1519624124d6681bfa91211b96b2

SHA1 hash:

4e24cbf53f526f1f8ffdd64697391038920c059a

Link:

https://www.unpac.me/results/b8926600-3ee0-4749-b5ce-f7e780b347c1/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7a2876686646/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.77

Link:

https://yomi.yoroi.company/submissions/7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 7a287668664674f891f7ec4b5a6ed21b6d966765f2219e350cd08cde4885dd30

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3131066/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample