MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 5 File information Comments 1

SHA256 hash:	a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e
SHA3-384 hash:	6b82d25a53742c9fb5ff808a6198568ea84ea54b65b677a8f0b95e7a538b2781ca9180af5248fa22adbecc9894a64497
SHA1 hash:	15e5081b9ce4efc92745d8db7774b6da44c53e5b
MD5 hash:	977f59f5fca6c3dfacd5494e118af4fb
humanhash:	michigan-triple-happy-bakerloo
File name:	977f59f5fca6c3dfacd5494e118af4fb
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	644'648 bytes
First seen:	2024-10-19 21:48:11 UTC
Last seen:	2024-10-19 23:42:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	de48de5d6e0f4635b5910437a0f3a073 (8 x LummaStealer, 3 x Vidar, 3 x RedLineStealer)
ssdeep	12288:TrzNpws1chUAziBZnNKG+orQLwzsVvxGew3i8hKSOEO:Zp7vXBZnQLsz/ewpgtt
TLSH	T125D4F102B1C080B6D57315321AF4EAB16F7DBD700B96598F67E81F7E4F30681AB24A97
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	zbetcheckin
Tags:	32 exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

417

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

977f59f5fca6c3dfacd5494e118af4fb

Verdict:

Malicious activity

Analysis date:

2024-10-19 21:49:30 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/a80abaf8-b4ad-4f9c-a045-582a02f9bc3f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.19979.8051.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Searching for synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Behavior that indicates a threat

Connection attempt to an infection source

Using the Windows Management Instrumentation requests

Query of malicious DNS domain

Sending a TCP request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/6714294e7184660038524e21/reports/abc561b3-ebbe-4e7a-921e-37827a8ed688/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

LummaC2 Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/59c21275-1a2c-4771-b009-80aeb7953368

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1537898

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-10-19 20:38:20 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

11 of 38 (28.95%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uokzv43jzicxajfjclcjjjdg5sp2q6l7jauzfg5yde7mxxm6ha7a._file

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/241019-1pbd1a1ckb/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Browser Information Discovery

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Lumma Stealer, LummaC

Malware Config

C2 Extraction:

https://drawwyobstacw.sbs
https://condifendteu.sbs
https://ehticsprocw.sbs
https://vennurviot.sbs
https://resinedyw.sbs
https://enlargkiw.sbs
https://allocatinow.sbs
https://mathcucom.sbs

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b17c8768-3c9e-44b2-b024-4054118003c8

Unpacked files

SH256 hash:

84033def9ffa70c7b77ce9a7f6008600c0145c28fe5ea0e56dfafd8474fb8176

MD5 hash:

1b9dfd4cb7f0414950c80a4e0ed96329

SHA1 hash:

95dede154fe7e31fea0bfca069c9d0ab686d41da

Detections:

LummaStealer

Link:

https://www.unpac.me/results/5f538649-b96a-43c0-a690-3d631384e838/

Parent samples :

cf102d7610f28529062646e721700d614f678989b04d22940bf3668da85c7931
e855881aa09ecd170bcbfb7f01f7306f765e0f3ed9fcd1cdf7282194023d11a4
38e97888ba4afeb7d201899983232093d618faae2a97bc860950c6bd63d6eecd
5c5140ec6f89d970f01c6a851784dbe9b8111a0a9bec83febb14808e564e7a9b
442a7999587b1912249170b3dcd69912563acb90dc252b67e8a6975677eb9616
402c5b4c3bc5504d50341852022370820b63f6e7ce7ba256f5d267b0b17b13ff
c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec
abfd6c2faaf0282b9aaccf76d62dd1d50c214aa61574a8a7fdaa0f263bb5b22c
65be512fec6fba2f8acf5859479fa200390bd96127e63d19846882385506f8d1
9793985587748f37b6695a12f3556d7f08cda565050478400151263d3cf5adaa
7cb6c4c633f649b1d59c5d0eb9782b40424c2b363772ec968c81d4902faf7a49
a916aaf05a06f21118822dfbc1bea35906bf2cb4ef2dce7bd3c320a45d2f4bef
1102be9e88e489cad3eefcd8a5671dedd10c261cceab465980d859efabb2c36d
a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e
5e775466410e42985d4d55a0043a7656cba3f4f6af11805d759e6a01f8f0af45
8843020b70dba72962910280a22ebdbd1a5f6a0fc50372509d3dc752443dfccd
eea8b75e3c8715b5b6693c320da19eff9a2eacef27e1565cbef68095bd3a98a1
cfee6bf7339c11e2ac0ed9a2c47d18d2fea7966b2d01fc79b4b4847dca6c4d85
d09e0c469a05b335bb50e5b15a4e203f6cf029e528a3065cc7dff9c5807ded05
253867c7c0ff443f04fc3b9c9d5cc0eb7c1d9d94c1560bdac29a1666befb36e8

SH256 hash:

a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e

MD5 hash:

977f59f5fca6c3dfacd5494e118af4fb

SHA1 hash:

15e5081b9ce4efc92745d8db7774b6da44c53e5b

Link:

https://www.unpac.me/results/5f538649-b96a-43c0-a690-3d631384e838/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a3959af369ca/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3244700/

URLhaus

https://urlhaus.abuse.ch/url/3244729/

URLhaus

https://urlhaus.abuse.ch/url/3244734/

URLhaus

https://urlhaus.abuse.ch/url/3244760/

URLhaus

https://urlhaus.abuse.ch/url/3242961/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-10-19 21:48:12 UTC

url : hxxp://app.cumpar-auto-orice-tip.ro/css/d74f5005fa82.exe