MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83
SHA3-384 hash: 4982795ac8057ae315609e005b6c7a007db049df1873556ee2ab3c12232be835dfbf530ba15ebf983c96928fc884c993
SHA1 hash: 4a89ffeec1771820537ec85a79917dd822a86488
MD5 hash: c9f0c137d5add06bf4416d084a844184
humanhash: ack-carbon-freddie-queen
File name:Ethelium.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:17'636'224 bytes
First seen:2025-02-17 08:36:37 UTC
Last seen:2025-02-17 09:48:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f3795cbabe5b17ca0ff8bab74bf7bda9 (3 x LummaStealer)
ssdeep 98304:nxAvkFogX0DKi6SqCaoZ1IO+LhsC5EK4OSemfLDtStVQRWQE4sOpVQRWQO:FFE6Lh1DmHtxW34iWV
Threatray 1 similar samples on MalwareBazaar
TLSH T1E607C462F71375AAC4537172D0E2C53421324D347B12429FE6CDBCA73AB62DA462DA3B
TrID 30.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
23.0% (.EXE) InstallShield setup (43053/19/16)
22.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
8.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.6% (.EXE) Win64 Executable (generic) (10522/11/4)
Magika pebin
File icon (PE):PE icon
dhash icon 0800307878300008 (3 x LummaStealer)
Reporter ventoy
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
500
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://etheliumcheats.top/
Verdict:
Malicious activity
Analysis date:
2025-02-16 16:46:30 UTC
Tags:
lumma stealer purecrypter netreactor
Link:
https://app.any.run/tasks/741ee277-a08d-4427-aa44-998e975e3571

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.25408.27185.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67b2f66fa0fd713c335b62b8
Tags:
malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context explorer fingerprint invalid-signature keylogger lolbin microsoft_visual_cc mmc obfuscated overlay packed packed packer_detected signed
Link:
https://www.filescan.io/uploads/67b2f53d1195447a80c47e5f/reports/b3003902-94ec-4420-ad3d-4d51614c3ce7/overview
Verdict:
Suspicious
Labled as:
TR/AD.Nekark
Link:
https://www.hybrid-analysis.com/sample/885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83
Result
Verdict:
UNKNOWN
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/09c34029-a1fa-4eb4-b4df-d0c57ba4e9ed
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1616846
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Silenttrinity Stager Msbuild Activity
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
89%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83/
Threat name:
Win32.Exploit.Generic
Create hunting rule
Status:
Malicious
First seen:
2025-02-15 15:29:23 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rbo5adkwk3e4c577gegzgums7pq4swftcaxcnfhrlbwinxcg5sbq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83
LummaStealer
error
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma adware discovery persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/250217-kh8g6axlam/
Behaviour
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Uses Task Scheduler COM API
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Installs/modifies Browser Helper Object
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Boot or Logon Autostart Execution: Active Setup
Downloads MZ/PE file
Lumma Stealer, LummaC
Lumma family
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
https://mercharena.biz/api
Verdict:
Suspicious
Tags:
lumma_stealer stealer lumma c2
YARA:
n/a
Link:
https://app.threat.zone/submission/939bfd3c-c1db-41f9-90b6-673952c9ceab
Unpacked files
SH256 hash:
885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83
MD5 hash:
c9f0c137d5add06bf4416d084a844184
SHA1 hash:
4a89ffeec1771820537ec85a79917dd822a86488
Link:
https://www.unpac.me/results/60e67beb-8950-4d51-8af5-7e1854532fe4/
SH256 hash:
db671556b84967a4c2a3ed3344081be9596164a5cf65c387d406de697fa36752
MD5 hash:
68ce5fd4f01d1b88667d02160443e20b
SHA1 hash:
97a24d612480a04da1daf492a4c2c2adfa98b200
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/60e67beb-8950-4d51-8af5-7e1854532fe4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:Windows_Trojan_Donutloader_f40e3759
Create hunting rule
Author:Elastic Security
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 885dd00d5656c9c177ff310d935192fbe1c958b3102e2694f1586c86dc46ec83

(this sample)

  
Link
https://tria.ge/250217-kfc88sxkcn/behavioral1
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::MapGenericMask
ADVAPI32.dll::RevertToSelf
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::mciSendStringA
WINMM.dll::midiOutClose
WINMM.dll::midiOutOpen
WINMM.dll::midiOutShortMsg
GDI32.dll::StretchDIBits
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AccessCheck
ADVAPI32.dll::GetFileSecurityW
ADVAPI32.dll::ImpersonateSelf
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::OpenThreadToken
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::CreateFiber
KERNEL32.dll::TerminateProcess
KERNEL32.dll::GetCommModemStatus
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegQueryValueExW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::RegisterServiceCtrlHandlerA
ADVAPI32.dll::StartServiceCtrlDispatcherA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExA

Comments