MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 6 File information Comments

SHA256 hash:	829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597
SHA3-384 hash:	282026d7903ad11347a295dafee52e9d49e96f0bc72abac8fb4ea56a703420c941f6472bb9f8686c32b1486c493b1aec
SHA1 hash:	c5d311f85fe98a6aca7f50dfea11e0432da27db7
MD5 hash:	e9c65505fb3b84a99839e30802ff4c6e
humanhash:	wyoming-bulldog-edward-skylark
File name:	nbtiapadkrtghja.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'310'720 bytes
First seen:	2025-03-29 08:35:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	71cc5af9daad65e58c6f29c42cdf9201 (140 x LummaStealer)
ssdeep	24576:/JN9lCJLBSf6tDtrNc4phtybGBfGyuVW+h+GhzAMe4rogvUI:xvl6LBsiQA9cyu8m+An8
Threatray	115 similar samples on MalwareBazaar
TLSH	T10255333F90195600F3AB2FF2E40455C4E0A19FA486BA87B779DD8F4E5DC9CFA14B9248
TrID	42.7% (.EXE) Win32 Executable (generic) (4504/4/1) 19.2% (.EXE) OS/2 Executable (generic) (2029/13) 19.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.9% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	tcains1
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

493

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

nbtiapadkrtghja.exe

Verdict:

Malicious activity

Analysis date:

2025-03-29 08:31:58 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/603b5352-7575-4296-ad83-f41f3d243f57

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

PUA.Win.Packer.EnigmaProtector-19

PUA.Win.Packer.EnigmaProtector-1

Win.Dropper.njRAT-9244937-0

PUA.Win.Packer.EnigmaProtector-9852682-0

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e7b1cacfd0a37f8309634e

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Connection attempt to an infection source

Using the Windows Management Instrumentation requests

Query of malicious DNS domain

Sending a TCP request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

enigma obfuscated obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67e7b0f5f274bf2d8e284db3/reports/846137bf-e153-4b59-81d9-8719760a5b25/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597

Malware family:

LummaC2 Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ea22c56e-e80b-4c0c-8fa4-bfe44c8beb6b

Result

Threat name:

LummaC Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1651660

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

PE file has nameless sections

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597/

Threat name:

Win32.Spyware.Lummastealer

Status:

Malicious

First seen:

2025-03-29 08:36:12 UTC

File Type:

PE (Exe)

AV detection:

23 of 24 (95.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qkkhtzmihvgisagb5avo67jfv7j677g4cgndbhicmwerwkvhewlq._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

47268fe68e22b14bfccf2d53d8ec55d72100774430f1504f49b088f04d93b2e5

LummaStealer

473f09866ecbc5972a53c7b1d5179f5acbbe3ee9306304914558afce69690e04

LummaStealer

574ac99a25c2a647686a419c9ba6c7109e44a33451d4d8071490aa265adc4540

LummaStealer

69af611bea457fc1c372bf333b2da65c9a0b5de828afe79d918458e67a70ab4a

LummaStealer

8044ef90039da44bd84ba788ca28ee0648e0672b2b6531af0c1f2961c1ae0ad3

LummaStealer

829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597

LummaStealer

900459b3a10b535eece51d001210663cd2475c2a8e4ce9b8d63fc2b957b4a020

LummaStealer

error

LummaStealer

+ 105 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/250329-khl9xs1p19/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks installed software on the system

Reads user/profile data of local email clients

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://smeltingt.run/giiaus
https://uik2oreheatq.live/gsopp
https://castmaxw.run/ganzde
https://weldorae.digital/geds
https://steelixr.live/aguiz
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://9smeltingt.run/giiaus
https://ferromny.digital/gwpd

Verdict:

Malicious

Tags:

Win.Dropper.njRAT-9244937-0

YARA:

n/a

Link:

https://app.threat.zone/submission/af6f2c5e-e099-4e72-a04a-28aa3ba9e791

Unpacked files

SH256 hash:

829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597

MD5 hash:

e9c65505fb3b84a99839e30802ff4c6e

SHA1 hash:

c5d311f85fe98a6aca7f50dfea11e0432da27db7

Link:

https://www.unpac.me/results/de13177b-13a2-4beb-9001-48c67598c841/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/829479e5883d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	EnigmaProtector11X13XSukhovVladimirSergeNMarkin Create hunting rule
Author:	malware-lu

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 48194604d5c6dd44cc1a517328f6fa5777e1f2a75b6e8f01828bdef93d797e0e

LummaStealer

exe 829479e5883d4c8900c1e82aef7d25afd3effcdc119a309d0265891b2aa72597

(this sample)

Dropped by

SHA256 48194604d5c6dd44cc1a517328f6fa5777e1f2a75b6e8f01828bdef93d797e0e

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3494724/

Dropped by

MD5 52ab552a39cbd9080c6609222805ef6c

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteA
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA
WIN_BASE_IO_API	Can Create Files	version.dll::GetFileVersionInfoA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample