MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 930a09e6ee090e9f2b67e1a37270b4c31e3cb4fdad55cd8db34b11519759f145. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	930a09e6ee090e9f2b67e1a37270b4c31e3cb4fdad55cd8db34b11519759f145
SHA3-384 hash:	5124da01558e5e6b9601303f282b3508d74de74c09183c70365a28601b8515be554bf056d0391fadce37f55d28cda48b
SHA1 hash:	ffa85842df96dac9f6dac782cb1081251eaac749
MD5 hash:	2b60655a425eaa036531f18e96741444
humanhash:	ack-lithium-stairway-seven
File name:	62.122.184.98 (3).ps1
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	537'125 bytes
First seen:	2025-01-14 16:59:05 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12288:srScfYL0kaO7oNtiE45hXTLr1qwofa54+:1QNtobTL5ofk4+
TLSH	T162B47D3141033C6E37AA2ECEA4006EC10C9D7997BB54D550AE899176B2BE13B4F6D9FC
Magika	powershell
Reporter	JAMESWT_WT
Tags:	62-122-184-98 booking LummaStealer ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

159

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PowerShell.Obfus-9.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678698154487910100def87c

Tags:

virus spawn

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

confuserex net obfuscated

Link:

https://www.filescan.io/uploads/6786981be7a06875ff2123c8/reports/308ab835-5007-40d4-af66-617958a35625/overview

Hybrid Analysis PowerShell/Agent.CDT trojan

Verdict:

Malicious

Labled as:

PowerShell/Agent.CDT trojan

Link:

https://www.hybrid-analysis.com/sample/930a09e6ee090e9f2b67e1a37270b4c31e3cb4fdad55cd8db34b11519759f145

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox LummaC

Result

Threat name:

LummaC

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1591131

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/930a09e6ee090e9f2b67e1a37270b4c31e3cb4fdad55cd8db34b11519759f145

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/930a09e6ee090e9f2b67e1a37270b4c31e3cb4fdad55cd8db34b11519759f145/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.LummaC

Threat name:

Script-PowerShell.Trojan.LummaC

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-14 06:15:35 UTC

File Type:

Text (PowerShell)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=smfatzxobehj6k3h4grxe4fuympdznh5vvk43dntjmivdf2z6fcq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250114-vhzkcstlcv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/930a09e6ee090e9f2b67e1a37270b4c31e3cb4fdad55cd8db34b11519759f145