🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0d5e55b1f53a81c034d8972af82fbb66565168a7aabcecbd0136b1a62e7a0c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 44 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0d5e55b1f53a81c034d8972af82fbb66565168a7aabcecbd0136b1a62e7a0c1
SHA3-384 hash: 13a52715b1bf0b632ca5b336870ae44bb70a86cd8ed703604c7ce9b16067f6971c17c8955b6db01b732f0531eeb687de
SHA1 hash: 1a1cd69a071e74ef01c23d718e312b9583acf2f3
MD5 hash: 0c3ed5a03c880b1c89fa2e8173a58905
humanhash: cat-stream-fix-green
File name:gig.zip
Download: download sample
Signature LummaStealer
Create hunting rule
File size:31'776'731 bytes
First seen:2024-10-31 13:40:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 786432:K0oC9my+gCXUxeEnw9laR9w+q9fYRTo2gNPPClZbkc6MlWAlhjHDT0//b:MCD+8xeEIY9wPVKlZbkQxjjT0nb
TLSH T11E67336B6B02EDA97D3EC325CB5ACB449A66E04E5C0C19067CCB2E765CEF6D4630DC06
Magika zip
Reporter ramirezrick2
Tags:lumma LummaC2 LummaStealer zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
US US
File Archive Information

This file archive contains 34 file(s), sorted by their relevance:

File name:Setup.exe
File size:31'744 bytes
SHA256 hash: 0e6f5eaa2cd91747213f6aec05e3de6fb46ea2b7cf4d5f3ac267128abc784d00
MD5 hash: 67dedab5bc0159f7cc61cb4b46daa6f1
MIME type:application/x-dosexec
Signature LummaStealer
File name:xlmyvd
File size:1'733'310 bytes
SHA256 hash: 8f6507a92acd6565fa513faf10a31424924465683889feb37155930a140f6e5b
MD5 hash: 42cf5333ca847a6a2f1dd2edf5add982
MIME type:application/octet-stream
Signature LummaStealer
File name:api-ms-win-core-synch-l1-2-0.dll
File size:18'384 bytes
SHA256 hash: 9ac63682e03d55a5d18405d336634af080dd0003b565d12a39d6d71aaa989f48
MD5 hash: 659e4febc208545a2e23c0c8b881a30d
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-core-timezone-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: a108a8f20ded00e742a1f818ef00eb425990b6b24a2bcd060dea4d7f06d3f165
MD5 hash: 69df2cce4528c9e38d04a461ba1f992b
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-core-profile-l1-1-0.dll
File size:17'360 bytes
SHA256 hash: d00a0edace14715bf79dbd17b715d8a74a2300f0adb1f3fc137edfb7074c9b0a
MD5 hash: 6ee66dca31c5cce57740d677c85b4ce7
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-process-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 542a22540cdb7df46d957a0208d50507916f7c737bea833931239d56ebe8d68c
MD5 hash: 66f4e530a19ed2f6862b5ce946437875
MIME type:application/x-dosexec
Signature LummaStealer
File name:tradingnetworkingsockets.dll
File size:4'249'928 bytes
SHA256 hash: fc4a65ff603bf1f4bfe323de1866145ae1e006aa656799fd134dfa63d92d47c1
MD5 hash: 3cf26ce759c5e261fe3ecc6451b8b08e
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-private-l1-1-0.dll
File size:70'608 bytes
SHA256 hash: 696c10112d8b86a46e5057cbd0bf40728e79c6bb49cda1f2c67fe45d0fc1258d
MD5 hash: ad8d9a6ea592a6c8a78c67a805cec952
MIME type:application/x-dosexec
Signature LummaStealer
File name:glib-2.0.dll
File size:1'074'880 bytes
SHA256 hash: 5cfa104a083d2b1d223f306b86829e5ae40cd0909c8d46828149296388d542a7
MD5 hash: 34f4b186c725c3948820c0ad65c42c27
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-heap-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 0166edfb23cfc77519c97862a538a69b5d805d6a17d6e235f46927af5c04b3c9
MD5 hash: 9c373c00ac3138233bdf1655c7be8e86
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-core-util-l1-1-0.dll
File size:17'872 bytes
SHA256 hash: 68bd9c086d210eb14e78f00988ba88ceaf9056c8f10746ab024990f8512a2296
MD5 hash: c6553959aecd5bac01c0673cfdf86b68
MIME type:application/x-dosexec
Signature LummaStealer
File name:opengl64.dll
File size:18'578'896 bytes
SHA256 hash: dd575f3c64382193610815909bd2c52490244ecbbb9bba6eef5fe4f0bb43bb4d
MD5 hash: 0a84667145e7efef026c888d4b768126
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-core-synch-l1-1-0.dll
File size:19'920 bytes
SHA256 hash: 8bb38a7a59fbaa792b3d5f34f94580429588c8c592929cbd307afd5579762abc
MD5 hash: 979c67ba244e5328a1a2e588ff748e86
MIME type:application/x-dosexec
Signature LummaStealer
File name:nvptxJitCompiler32.dll
File size:17'375'864 bytes
SHA256 hash: caa6ae6c505e54875761443171c229ed367b2e51e448a9034b81be062b961847
MD5 hash: 3ea5205d6831ddc3670ab8eeacb853f5
MIME type:application/x-dosexec
Signature LummaStealer
File name:vmtools.dll
File size:632'000 bytes
SHA256 hash: 4e5f2c54d9ecfe48999edfcce0de038948f8b20ff68e299c55d9a2d6f65713e8
MD5 hash: 65c3c2a741838474a592679cda346753
MIME type:application/x-dosexec
Signature LummaStealer
File name:AbRoot.dll
File size:364'496 bytes
SHA256 hash: 9fbeab4bcfcec34dc13cad90609101b2ea099069ab173555635f174597e4ea09
MD5 hash: 530957a391c6bc978ae7179179594b12
MIME type:application/x-dosexec
Signature LummaStealer
File name:iconv.dll
File size:1'124'544 bytes
SHA256 hash: 84538f1aacebf9daad9fdb856611ab3d98a6d71c9ec79a8250eee694d2652a8b
MD5 hash: 862dfc9bf209a46d6f4874614a6631cc
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-math-l1-1-0.dll
File size:27'088 bytes
SHA256 hash: c7115159babdaa1f52e478e67b4e612da2332fda4e4036999b29425fe303b6e8
MD5 hash: bc418a3461c5fdfa1a0d75f7e03d08a7
MIME type:application/x-dosexec
Signature LummaStealer
File name:nvdisps.dll
File size:11'656'736 bytes
SHA256 hash: 77173b4b61b59eca507ca3ece87a77a87e4e77a48dd162ba813d61cb0513421d
MD5 hash: da3e5ecda1487fdbcc6d7db314815696
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-core-rtlsupport-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: d11093fdc1d5c9213b9b2886ce91db3ded17ef8dae1615a8c7ffbc55b8e3f79b
MD5 hash: 0069fd29263c0dd90314c48bbce852ef
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-filesystem-l1-1-0.dll
File size:19'920 bytes
SHA256 hash: 85b1b189ce9e3c6f4d2efdd4cd82b0807f681bea2d28851caaf545990de99000
MD5 hash: 14f407d94c77b1b0039ae2c89b07a2ff
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-conio-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 4aeeae0ac9f6c1b0b8835067ea3b7fc429f353565f18de7858f4ea5d6f72072e
MD5 hash: 7190cbfad2d7773d3b88ccc25533a651
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-core-processthreads-l1-1-1.dll
File size:18'384 bytes
SHA256 hash: e5ea2c21fb225090f7d0db6c6990d67b1558d8e834e86513bc8ba7a43c4e7b36
MD5 hash: 29001f316ccfc800e2246743df9b15b3
MIME type:application/x-dosexec
Signature LummaStealer
File name:trading_api64.dll
File size:289'568 bytes
SHA256 hash: f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
MD5 hash: 2bca4e2c047ec969cb3cff277e7fc184
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-core-sysinfo-l1-1-0.dll
File size:18'896 bytes
SHA256 hash: 1fe918979f1653d63bb713d4716910d192cd09f50017a6ecb4ce026ed6285df9
MD5 hash: cef4b9f680faae322170b961a3421c5b
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-convert-l1-1-0.dll
File size:21'968 bytes
SHA256 hash: 77b69e829bdc26c7b2474be6b8a2382345b2957e23046897e40992a8157a7ba1
MD5 hash: 3e415147ccd7c712618868bdd7a200cd
MIME type:application/x-dosexec
Signature LummaStealer
File name:ks_tyres.ini
File size:10'077 bytes
SHA256 hash: 894d3c57598ecb22c769cc3ea8219859a95e22740e72394a474012ea2119b3d9
MD5 hash: 47f6571c7884da6c743551ac724186d4
MIME type:text/plain
Signature LummaStealer
File name:api-ms-win-crt-locale-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: f16447b5fc7fe6fb8a6699a3cef1b2b8ba92d408579bcc272d3dd76acd801e2a
MD5 hash: c5d747f96237b6e9aa85c58745d30c80
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-environment-l1-1-0.dll
File size:18'384 bytes
SHA256 hash: 6c9c0dc7b36afe07dfb07dd373fc757ff25df4793e6384d7a6021471a474f0b9
MD5 hash: ad0cbb9978fcf60d9e9ca45de6a28d30
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-core-string-l1-1-0.dll
File size:17'872 bytes
SHA256 hash: 3807db7acf1b40c797e4d4c14a12c3806346ae56b25e205e600be3e635c18d4f
MD5 hash: 2e5c29fc652f432b89a1afe187736c4d
MIME type:application/x-dosexec
Signature LummaStealer
File name:myjcof
File size:19'040 bytes
SHA256 hash: c9daa6bd20faeb4252694a7110f7de629bd0770fe675d8fa735bac3a84fe5e22
MD5 hash: 978843a008ad2bde765a160626fa0418
MIME type:application/octet-stream
Signature LummaStealer
File name:intl.dll
File size:89'280 bytes
SHA256 hash: 6a64c9cb0904ed48ce0d5cda137fcfd6dd463d84681436ca647b195aa2038a7e
MD5 hash: d1a21e38593fddba8e51ed6bf7acf404
MIME type:application/x-dosexec
Signature LummaStealer
File name:nvdispsr.dll
File size:11'575'304 bytes
SHA256 hash: 0681d4e92b84d238b3e3fb118b0a359be1aba83528b94f7fde2d9101d8163417
MD5 hash: d74d7dca89d97bc912a376a5c34172b1
MIME type:application/x-dosexec
Signature LummaStealer
File name:api-ms-win-crt-multibyte-l1-1-0.dll
File size:26'064 bytes
SHA256 hash: c6b4e1d903b3cc83bfaffbe4e82eee634cff8f97f12217caa45b464ddc4e1455
MD5 hash: 9e9c6f83a015029808f5257f7b7e39c6
MIME type:application/x-dosexec
Signature LummaStealer
Vendor Threat Intelligence
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6723815249e92a05dde213ac
Tags:
vmdetect
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
microsoft_visual_cc
Link:
https://www.filescan.io/uploads/672388f70b051f847ca75c69/reports/c4465774-6333-4f33-8f23-3a216a19d429/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b0d5e55b1f53a81c034d8972af82fbb66565168a7aabcecbd0136b1a62e7a0c1
Score:
49%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/b0d5e55b1f53a81c034d8972af82fbb66565168a7aabcecbd0136b1a62e7a0c1
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-10-31 02:24:40 UTC
File Type:
Binary (Archive)
Extracted files:
2215
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wdk6kwy7koubya2nrfzk7ax3wzswkfukpkv45s6qcnvruyxhudaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lumma
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b0d5e55b1f53a81c034d8972af82fbb66565168a7aabcecbd0136b1a62e7a0c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:Check_VmTools
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:golang
Create hunting rule
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

zip b0d5e55b1f53a81c034d8972af82fbb66565168a7aabcecbd0136b1a62e7a0c1

(this sample)

DLL dll 5cfa104a083d2b1d223f306b86829e5ae40cd0909c8d46828149296388d542a7

  
Link
https://www.virustotal.com/gui/file/b0d5e55b1f53a81c034d8972af82fbb66565168a7aabcecbd0136b1a62e7a0c1
  
Dropping
SHA256 5cfa104a083d2b1d223f306b86829e5ae40cd0909c8d46828149296388d542a7
  
Delivery method
Distributed via web download

Comments