MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 5 File information Comments 1

SHA256 hash:	a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7
SHA3-384 hash:	179af2c09966f17fd1807275e8cfe62f19b8b670c13ed338d7ed5f5c167de661073bea7c0b6a797ea39ca12c5e8f58b0
SHA1 hash:	fa2dd92aa54911b5e6d13b01abdad7674fceb877
MD5 hash:	3098a67c2dd66570a2b7fac6148d5a3f
humanhash:	coffee-nuts-eighteen-white
File name:	3098a67c2dd66570a2b7fac6148d5a3f
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	648'232 bytes
First seen:	2024-10-19 21:43:18 UTC
Last seen:	2024-10-19 23:42:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	de48de5d6e0f4635b5910437a0f3a073 (8 x LummaStealer, 3 x Vidar, 3 x RedLineStealer)
ssdeep	12288:WBZxHcqF2T8O5Qk08Ect9eQ8Nv0eYmktFLm2Ce9s63iPDKSVEO:OH9KD5Qk0xoEdym2HjVGt
Threatray	6 similar samples on MalwareBazaar
TLSH	T1EBD4F212B4C080B6D5B3193206E4D7B06B7EB9704B559D4FA7E80FBE4F30681DB25E9A
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	zbetcheckin
Tags:	32 exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

425

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

3098a67c2dd66570a2b7fac6148d5a3f

Verdict:

Malicious activity

Analysis date:

2024-10-19 21:46:29 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/91ec4fc5-e187-4793-a563-c8994176dad9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.17330.25193.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Searching for synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Behavior that indicates a threat

Connection attempt to an infection source

Using the Windows Management Instrumentation requests

Query of malicious DNS domain

Sending a TCP request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/67142823551363d3cb7bd69c/reports/c74f70f5-04a2-4d87-97f8-44f0ade1f832/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

LummaC2 Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4018597e-7159-4430-94b5-88b911e1fa7e

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1537896

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-10-19 20:09:25 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 38 (55.26%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uycevekczy762x2nwckeba67riovdos5s5hnvfedcddbc2w52dlq._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

885c6941d87ec16785da0ebbffd5334c06a5a1344b67f603937917b9ace9504d

LummaStealer

a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7

LummaStealer

cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8

LummaStealer

error

LummaStealer

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/241019-1lf53s1aqc/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Browser Information Discovery

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Lumma Stealer, LummaC

Malware Config

C2 Extraction:

https://conceptionnyi.sbs
https://platformcati.sbs
https://nervepianoyo.sbs
https://qualifielgalt.sbs
https://smashygally.sbs
https://fightyglobo.sbs
https://modellydivi.sbs
https://pioneeruyj.sbs

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/79b17c2c-eae8-4215-977b-befa5a729669

Unpacked files

SH256 hash:

6e3a3bbf6478c8e6c63d22f887a00fc8655e10212e16bf87fdcbc7306f7ea569

MD5 hash:

19f6446cf95c440e28c519ccfa46e07a

SHA1 hash:

b6d6ed35f3a7df542d788456a6478550da339fac

Detections:

LummaStealer

Link:

https://www.unpac.me/results/75dcec44-0676-41f2-afa5-b4abc38a3dc0/

Parent samples :

cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8
885c6941d87ec16785da0ebbffd5334c06a5a1344b67f603937917b9ace9504d
a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7
bffe5190d5f063e1d2650a4282d4ea0fd3f02e824773c7dc767ef915089db457
b1621c26902c7492590479c9739e9271ea8ff066bc2c2eed9ce1f8599da328d1
8456cc2d2a31cb075f95053c8eb886a47ba8381a2ba2fbe0866120fb24ff41bd
5bd0a7c399000541ab5f7398af02d5ced96e4f3adcea59a63c35dcf890bdc8de
f63fec027d91bf28bf3e219ee984a500c6943f3e0455a27bad178ed93fadeb1c
a7756930981261f94e828a6e4edd39c82dc2959cd0c03a8e65efd73cb8939cd2
ba833b2b6210b781718e625b632e46751ab28582a5f1e475c44a425b3409ee2a
21424c9386ed6c518f89ffd488b7d32e64c34d1c9162c5935db4bf29efb72e32
1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d

SH256 hash:

a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7

MD5 hash:

3098a67c2dd66570a2b7fac6148d5a3f

SHA1 hash:

fa2dd92aa54911b5e6d13b01abdad7674fceb877

Link:

https://www.unpac.me/results/75dcec44-0676-41f2-afa5-b4abc38a3dc0/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a6044a9142ce/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3244748/

URLhaus

https://urlhaus.abuse.ch/url/3244750/

URLhaus

https://urlhaus.abuse.ch/url/3244768/

URLhaus

https://urlhaus.abuse.ch/url/3242963/

URLhaus

https://urlhaus.abuse.ch/url/3237137/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-10-19 21:43:19 UTC

url : hxxp://147.45.47.185/css/63e909b3647d.exe