MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97a364ff3b248837046a1a91dfae0dc5424a4d0b25d273c25e059556f4ce7cc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	97a364ff3b248837046a1a91dfae0dc5424a4d0b25d273c25e059556f4ce7cc5
SHA3-384 hash:	f7341cb48d7b03f331565deee48b98b1fe85fef4ad7bc7376430015b6e96d51af48239d08938f301f21e72bd48f3e464
SHA1 hash:	d1063e55fa3e7e39bde9f2a1459540a75f2671a9
MD5 hash:	798ee5cd327410648aafc0f4600aec94
humanhash:	avocado-helium-arizona-bulldog
File name:	67c2163c9db39.vbs
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	15'403 bytes
First seen:	2025-02-28 22:16:53 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:Paeeeeeeeeeeeeeesf8IgLjX6MxdM/SiTc7NF9Wu0MDxpnO/9CYhi:xf8IgLDz6a1v10MFpWCY0
TLSH	T1736294418E55CFE00E5BB52CAD8738265614A32F6038BFCAEE934EDC39FD9145A946CC
Magika	vba
Reporter	aachum
Tags:	LummaStealer vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

96

Origin country :

ES

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

TwinWave.EvilVBA.LostAtSeaFuncInDirection.20240306.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c235412dfba428b46f4f1a

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/67c235eb4a3011c802c46512/reports/611005af-f9fe-4f96-b2c8-f805064dd48c/overview

Hybrid Analysis VBS/Agent.BWT

Verdict:

Suspicious

Labled as:

VBS/Agent.BWT

Link:

https://www.hybrid-analysis.com/sample/97a364ff3b248837046a1a91dfae0dc5424a4d0b25d273c25e059556f4ce7cc5

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1626836

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/97a364ff3b248837046a1a91dfae0dc5424a4d0b25d273c25e059556f4ce7cc5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/97a364ff3b248837046a1a91dfae0dc5424a4d0b25d273c25e059556f4ce7cc5/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s6rwj7z3esedobdkdki57lqnyvbeutilexjhhqs6awkvn5goptcq._file

Threatray lummastealer

Verdict:

malicious

Label(s):

lummastealer

Alert

Create hunting rule

Similar samples:

error

LummaStealer

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution spyware

Link:

https://tria.ge/reports/250228-17d8lszycw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/97a364ff3b248837046a1a91dfae0dc5424a4d0b25d273c25e059556f4ce7cc5