MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a58b87f315fd77116edce2744e443d0ce6bab9e087a2ead50626e986314f949e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a58b87f315fd77116edce2744e443d0ce6bab9e087a2ead50626e986314f949e
SHA3-384 hash:	f4868e04f8d5f2f8c357d05e4db9d17f18fa48d71a91af9257e8a6a0218776c37682d939dfc7a4a240087c26e97d3dc5
SHA1 hash:	57e2cbcfa3293069c7f8058fd70bb160797fce91
MD5 hash:	92dc3bfc98f9d448b015125231f3bd6a
humanhash:	steak-carbon-carbon-eight
File name:	Satınalma siparişi ve numuneler.exe
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	412'672 bytes
First seen:	2023-07-19 12:52:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e3ff19f7172c13237bee4639264542fc (1 x Glupteba, 1 x LummaStealer)
ssdeep	12288:wxqsuSw7uDI0N5o+RwIwZpaBcbT4DW9l:w5w6z5PRw9i+oD
TLSH	T18F94F12232A08076E4B35A30197192816FBB79729B3555CF37A4233E1F713E1AB74B5B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	34f4e4ece4f0e4e4 (1 x LummaStealer)
Reporter	abuse_ch
Tags:	exe geo LummaStealer TUR

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

284

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Satınalma siparişi ve numuneler.exe

Verdict:

Malicious activity

Analysis date:

2023-07-19 12:57:35 UTC

Tags:

lumma

Link:

https://app.any.run/tasks/e50d68da-f6d7-4967-a472-074da9f22138

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/424877/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.29089.19061.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/a58b87f315fd77116edce2744e443d0ce6bab9e087a2ead50626e986314f949e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b674622d-59b0-4c9f-a706-a3f9189015d7

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1276066

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a58b87f315fd77116edce2744e443d0ce6bab9e087a2ead50626e986314f949e/

ReversingLabs TitaniumCloud Win32.Ransomware.Phobos

Threat name:

Win32.Ransomware.Phobos

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-19 08:29:15 UTC

File Type:

PE (Exe)

Extracted files:

13

AV detection:

21 of 25 (84.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uwfyp4yv7v3rc3w44j2e4rb5bttlvopaq6rovvige3uymmkpsspa._file

Threatray malicious

Verdict:

malicious

Hatching Triage lumma

Result

Malware family:

lumma

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/230719-p3284aff3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Lumma Stealer

UnpacMe 2

Unpacked files

SH256 hash:

ff1cfddbdd02146bfcf233d958776f8a4ad930d3e42ab6f64184d7c42b2242c7

MD5 hash:

26c01dbc903f2c9f4dd641086d20a9fb

SHA1 hash:

591f3199f5ab99c9caac4c87dc905f75456cdd38

Link:

https://www.unpac.me/results/e1941c2b-ceee-4434-9bfd-07ea9aa3b3c1/

SH256 hash:

a58b87f315fd77116edce2744e443d0ce6bab9e087a2ead50626e986314f949e

MD5 hash:

92dc3bfc98f9d448b015125231f3bd6a

SHA1 hash:

57e2cbcfa3293069c7f8058fd70bb160797fce91

Link:

https://www.unpac.me/results/e1941c2b-ceee-4434-9bfd-07ea9aa3b3c1/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a58b87f315fd/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a58b87f315fd77116edce2744e443d0ce6bab9e087a2ead50626e986314f949e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

LummaStealer

exe a58b87f315fd77116edce2744e443d0ce6bab9e087a2ead50626e986314f949e

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/424877/