MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b
SHA3-384 hash: a14ee3a164ff4bd45678128744705832806454725298337a7faab1f6b2ec7fda78264099bf639c46453ec0787a17e879
SHA1 hash: d529652f0ba92febad36c66a1b5be4398eddaef2
MD5 hash: 8351aa212d7278c381ebe13f2a435ad9
humanhash: yankee-potato-purple-low
File name:8351aa212d7278c381ebe13f2a435ad9
Download: download sample
Signature LummaStealer
Create hunting rule
File size:584'704 bytes
First seen:2024-10-07 16:41:48 UTC
Last seen:2024-10-07 17:25:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d10af643340e1121562abe3e6bd5b0e1 (14 x Stealc, 13 x LummaStealer, 9 x Vidar)
ssdeep 12288:fls0xfgBSzcsLJPVB1DrYoLRn/4CAkJwh9Jb6OYDU3zHCf4S:fHfgeDPMoLRwCAY06S39
Threatray 284 similar samples on MalwareBazaar
TLSH T162C4F11272C1C472D573163246F4DAB5AA7EB8B00F628EDF67940B7E8B306D1D721A63
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter zbetcheckin
Tags:32 exe LummaStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
452
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
8351aa212d7278c381ebe13f2a435ad9
Verdict:
Malicious activity
Analysis date:
2024-10-07 16:45:21 UTC
Tags:
vidar stealer stealc loader
Link:
https://app.any.run/tasks/5a523a59-c885-4e4b-9ced-d7bd184b6463

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.6508.1081.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67040f60b932c04ee8fde1e4
Tags:
Malware
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/67040f614f53598f1492b6b4/reports/baa79656-5e43-48aa-a928-93304f6fa010/overview
Verdict:
Malicious
Labled as:
Mikey.Generic
Link:
https://www.hybrid-analysis.com/sample/a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0e6f8f76-eeef-4b87-8f4c-f6f3daada426
Result
Threat name:
LummaC, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1528299
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Country aware sample found (crashes after keyboard check)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Silenttrinity Stager Msbuild Activity
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528299 Sample: f1r6P3j3g7.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 100 53 wickedneatr.sbs 2->53 55 lade.petperfectcare.com 2->55 57 12 other IPs or domains 2->57 67 Suricata IDS alerts for network traffic 2->67 69 Found malware configuration 2->69 71 Antivirus detection for URL or domain 2->71 73 16 other signatures 2->73 10 f1r6P3j3g7.exe 1 2->10         started        signatures3 process4 signatures5 83 Writes to foreign memory regions 10->83 85 Allocates memory in foreign processes 10->85 87 Injects a PE file into a foreign processes 10->87 13 MSBuild.exe 1 178 10->13         started        18 MSBuild.exe 10->18         started        20 WerFault.exe 21 16 10->20         started        22 MSBuild.exe 10->22         started        process6 dnsIp7 59 lade.petperfectcare.com 95.164.90.97, 49742, 51632, 80 VAKPoltavaUkraineUA Gibraltar 13->59 61 cowod.hopto.org 45.132.206.251, 53642, 80 LIFELINK-ASRU Russian Federation 13->61 63 nsdm.cumpar-auto-orice-tip.ro 147.45.44.104, 51636, 80 FREE-NET-ASFREEnetEU Russian Federation 13->63 43 C:\Users\user\AppData\Local\...\sql[1].dll, PE32 13->43 dropped 45 C:\Users\user\AppData\...\softokn3[1].dll, PE32 13->45 dropped 47 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 13->47 dropped 51 12 other files (8 malicious) 13->51 dropped 89 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->89 91 Found many strings related to Crypto-Wallets (likely being stolen) 13->91 93 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 13->93 99 4 other signatures 13->99 24 KEGIDHJKKJ.exe 1 13->24         started        27 cmd.exe 1 13->27         started        95 Contains functionality to inject code into remote processes 18->95 97 Searches for specific processes (likely to inject) 18->97 49 C:\ProgramData\Microsoft\...\Report.wer, Unicode 20->49 dropped file8 signatures9 process10 signatures11 75 Antivirus detection for dropped file 24->75 77 Machine Learning detection for dropped file 24->77 79 Writes to foreign memory regions 24->79 81 2 other signatures 24->81 29 MSBuild.exe 24->29         started        32 WerFault.exe 20 16 24->32         started        35 conhost.exe 27->35         started        37 timeout.exe 1 27->37         started        process12 dnsIp13 65 wickedneatr.sbs 188.114.96.3, 443, 53640, 53641 CLOUDFLARENETUS European Union 29->65 39 WerFault.exe 20 16 29->39         started        41 C:\ProgramData\Microsoft\...\Report.wer, Unicode 32->41 dropped file14 process15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b/
Threat name:
Win32.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2024-10-07 17:01:35 UTC
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vbwhwznggsgtsliq2omcw3ilrfx56zdlegeqhias2pan24yvt5nq._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
Similar samples:
2bda40435881101ace72e48ffcc04afa3e5ca6e9e6caf79b0a5a132840152ada
LummaStealer
548617ec6305c654f71be990786ad737c3fce173e319c78f78d074589f72dbdc
LummaStealer
9714d301c8b96c7263dea4a36ddbdf74896d31f648d2836fa2d2642dccca17e8
LummaStealer
e87d959e9c41f1e49f73d74442df2421f7b8ff121631f18509e0476273f3b97b
LummaStealer
error
LummaStealer
ff5e995f1c2441adff9759b8ee589e90744758fdc40f1b8eccf02562eb708cb1
LummaStealer
+ 274 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:lumma family:vidar credential_access discovery spyware stealer
Link:
https://tria.ge/reports/241007-t7pk1szfqr/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Browser Information Discovery
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Executes dropped EXE
Loads dropped DLL
Unsecured Credentials: Credentials In Files
Downloads MZ/PE file
Vidar
Detect Vidar Stealer
Lumma Stealer, LummaC
Malware Config
C2 Extraction:
http://lade.petperfectcare.com:80
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
Verdict:
Malicious
Tags:
stealc vidar stealc
YARA:
n/a
Link:
https://app.threat.zone/submission/cad177f3-9d43-4fe0-9b49-272a600c7d04
Unpacked files
SH256 hash:
0a6b558dc092b4f6bce802a6407fe468f7b973c82db36e2d7a0d0db5635838b4
MD5 hash:
1fbd01ee768b7c4abfd2783a4707a072
SHA1 hash:
15288415ec755c2673da3c716386abfdd35aaaed
Link:
https://www.unpac.me/results/a6cca55c-33bd-4308-b8e5-43479aca5e22/
SH256 hash:
ebfbd3cd9b8850e166d104312b872915afae27297e500671e6bc99e4c82b89d4
MD5 hash:
70d5119645a6b22a5ffab20366b687fe
SHA1 hash:
d0c50c22f7930f8467dfe86c6ea84ff7099a593b
Detections:
VidarStealer
Create hunting rule
Link:
https://www.unpac.me/results/a6cca55c-33bd-4308-b8e5-43479aca5e22/
Parent samples :
103e3e0fdd828c1aaaadf178b599d3d17c11689f62f5f89b50647a8e5a2b7c09
ac149ec67122ffb6e55e9098115644275b22495c9e0409bff3768d5169d6d6ff
e87d959e9c41f1e49f73d74442df2421f7b8ff121631f18509e0476273f3b97b
a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b
SH256 hash:
a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b
MD5 hash:
8351aa212d7278c381ebe13f2a435ad9
SHA1 hash:
d529652f0ba92febad36c66a1b5be4398eddaef2
Link:
https://www.unpac.me/results/a6cca55c-33bd-4308-b8e5-43479aca5e22/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a86c7b65a634/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Stealc
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3213217/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments


Avatar
zbet commented on 2024-10-07 16:41:49 UTC

url : hxxp://jask.powerforxes.shop/ldms/fedf8679e8d2.exe