MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 5 File information Comments

SHA256 hash:	810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b
SHA3-384 hash:	1a8f3822e981668782d3055e3131eeefaaa327190979115e4d13039763740fb0d9208ffbc07aaa6b6065405cc089c098
SHA1 hash:	cb36677ef6da00ecde6aa65682a24de4727cc6fb
MD5 hash:	720cd00d8a0b885c7c3fad7be48891bc
humanhash:	stairway-asparagus-autumn-saturn
File name:	Set-up_patched.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	8'594'944 bytes
First seen:	2025-02-01 16:55:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7dff8bff05959b29c4fc50356e19b532 (2 x LummaStealer)
ssdeep	98304:ljdqPsOawQXnEkD8yGuMFyJIw20pTjFq+r34/x:dd0sOIEa4u2ML20Nj4+LAx
TLSH	T12B86BE22BB51D46AE0674A38D80FA2EC7511BD646F34849736A02FCDB7B67C5B939303
TrID	47.6% (.EXE) InstallShield setup (43053/19/16) 15.6% (.EXE) Win32 Executable Delphi generic (14182/79/4) 11.6% (.EXE) Win64 Executable (generic) (10522/11/4) 11.0% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2) 4.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	0513ec3972765c0d (7 x LummaStealer, 1 x Meterpreter, 1 x Amadey)
Reporter	aachum
Tags:	de-pumped exe LummaStealer

iamaachum

https://jfdiw5za.com/ => https://www.mediafire.com/file/5572s128efyylqz/!@Pa$$w0rDs__6678--0pe%C9%B4_set-Ups#!.zip/file

Intelligence

File Origin

# of uploads :

# of downloads :

489

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Set-up_patched.exe

Verdict:

Malicious activity

Analysis date:

2025-02-01 16:55:35 UTC

Tags:

stealer lumma delphi

Link:

https://app.any.run/tasks/550a00c3-e09c-4105-b143-49659ed06d3f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.18153.30723.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=679e5206416a81ccc3c4e555

Tags:

shellcode injection phishing obfusc

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Creating a file in the %temp% directory

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt to an infection source

Behavior that indicates a threat

Query of malicious DNS domain

Sending a TCP request to an infection source

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context borland_delphi fingerprint keylogger overlay packed packed packer_detected

Link:

https://www.filescan.io/uploads/679e523c1b148287dc1e73d7/reports/46e74b44-1444-4407-a196-a262f5180a0f/overview

Verdict:

Malicious

Labled as:

Win/grayware_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/c493dcbe-e55f-4a68-aafe-1516f4f21749

Result

Threat name:

LummaC Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1604580

Signature

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected AntiVM3

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

40%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b/

Threat name:

Win32.Trojan.Lumma

Status:

Malicious

First seen:

2025-02-01 16:55:36 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

5 of 38 (13.16%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qegljuzsvxue4s5qutmvegamznhfikhbsrc7t5oxdtkxu4bqz4vq._file

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/250201-vfv46a1ndt/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://toppyneedus.biz/api

Verdict:

Suspicious

Tags:

c2 lumma_stealer stealer lumma

YARA:

n/a

Link:

https://app.threat.zone/submission/11906237-1653-42a7-9627-f4e32915fe31

Unpacked files

SH256 hash:

810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b

MD5 hash:

720cd00d8a0b885c7c3fad7be48891bc

SHA1 hash:

cb36677ef6da00ecde6aa65682a24de4727cc6fb

Link:

https://www.unpac.me/results/3e652592-be04-4c66-a67c-44680adacb44/

SH256 hash:

678359c47ac8bbbd30d02b4a3663a7b644d24b40255dd1029cc1b1fc0d454fd6

MD5 hash:

d3b55e81d22181faac45025fa324fbb6

SHA1 hash:

46dd39a49d024acc0a659b8e26014fa29dcc7e5e

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/3e652592-be04-4c66-a67c-44680adacb44/

Parent samples :

822b737a9db5ead10aec86a34feb57141e43c5679b620ce3191d335997a3f44d
59ae8d923ec039ce1f269ac6bd85486842f399d9e027bf113c53628410bad6bc
810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b
debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364
5d5e2231b8a8febafd04afef45760857c1a601b91dfb0c7c81881c9eadcf0e8a
9fe86d6c49079c5c47955ea7b2c04a1b9e16340b88799fc02bceaee4e4f3e99e

SH256 hash:

a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0

MD5 hash:

cabb58bb5694f8b8269a73172c85b717

SHA1 hash:

9ed583c56385fed8e5e0757ddb2fdf025f96c807

Link:

https://www.unpac.me/results/3e652592-be04-4c66-a67c-44680adacb44/

SH256 hash:

68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe

MD5 hash:

d4dae7149d6e4dab65ac554e55868e3b

SHA1 hash:

b3bea0a0a1f0a6f251bcf6a730a97acc933f269a

Link:

https://www.unpac.me/results/3e652592-be04-4c66-a67c-44680adacb44/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	MoleBoxv20 Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

zip fe860f7ab7763f9b394551f6e2a610050e246fb07ed0f46dd199263209e382fa

LummaStealer

exe 810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b

(this sample)

Delivery method

Distributed via web download

Dropped by

SHA256 fe860f7ab7763f9b394551f6e2a610050e246fb07ed0f46dd199263209e382fa

Dropped by

MD5 75c6d209f0a2a18bb5bb2748cbe3f1a3

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	gdi32.dll::StretchDIBits
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteA shell32.dll::SHFileOperationA
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle wininet.dll::InternetCloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetDriveTypeA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateDirectoryA kernel32.dll::CreateFileA kernel32.dll::DeleteFileA kernel32.dll::MoveFileA kernel32.dll::GetFileAttributesA kernel32.dll::FindFirstFileA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::EmptyClipboard user32.dll::FindWindowExA user32.dll::FindWindowA user32.dll::OpenClipboard

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample