MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6aa024e2681961c93d29f8600baa935b545e274db48eb832de1f3dea17db546. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6aa024e2681961c93d29f8600baa935b545e274db48eb832de1f3dea17db546
SHA3-384 hash: 9e398f80e821b9a57bd293926269f35d423a6b4b8d1b86e361a3e2ac62d1669065477bb135d847c13a8ad23d42636fdc
SHA1 hash: 7e5da59abc430b41183e5e1b3948c0bc39c402bb
MD5 hash: 5230300086eca8ba0698f2b8d10c0686
humanhash: louisiana-low-nitrogen-solar
File name:5230300086ECA8BA0698F2B8D10C0686.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'769'376 bytes
First seen:2023-10-10 19:31:09 UTC
Last seen:2023-10-10 20:35:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:gugysnxjW35QIn19Zw8hxh22Rm/SFo61zt5MvxQGBLR2eeMty:gugyExjM86lU72Z
TLSH T175D5F83C4C268737D279C229D0D89817F1A14497FA31AF8E21CB9B9AA9436477CC1F9D
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 3832a090b020bad2 (1 x LummaStealer)
Reporter abuse_ch
Tags:exe LummaStealer signed

Code Signing Certificate

Organisation:Intel Core i5-13400 Raptor Lake-S LGA1700
Issuer:Intel Core i5-13400 Raptor Lake-S LGA1700
Algorithm:sha512WithRSAEncryption
Valid from:2023-10-07T06:29:26Z
Valid to:2026-02-17T00:00:00Z
Serial number: 5fbe9c93611c9e43b98e02278e890ad3
Intelligence: 4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: e175355885ce0b768bbd4caeb7f0dd3d630062558e66dccadcb14ab993b0b169
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
LummaStealer C2:
http://orgstekomnw.pw/api

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Passwrrd-2024-Setup.rar
Verdict:
Malicious activity
Analysis date:
2023-10-08 16:20:25 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/f8631791-0f6b-4517-9183-5050f1a2dfab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/452987/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.69676641.8579.27204.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Sending an HTTP GET request
Sending an HTTP POST request
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Launching a process
Stealing user critical data
Query of malicious DNS domain
Sending a TCP request to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control lolbin packed
Link:
https://www.filescan.io/uploads/6525a6b3426c8727d6f7e5d0/reports/bac4a530-bf1d-40c9-a5a1-64edabf3faa8/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/b6aa024e2681961c93d29f8600baa935b545e274db48eb832de1f3dea17db546
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
LummaC2 Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/29f759d3-c214-4495-8462-736656706f6f
Result
Threat name:
LummaC Stealer, MicroClip
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1323214
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large strings
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected VMProtect packer
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected LummaC Stealer
Yara detected MicroClip
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1323214 Sample: fcoFomyM6G.exe Startdate: 10/10/2023 Architecture: WINDOWS Score: 100 43 orgstekomnw.pw 2->43 45 toolstechs.com 2->45 59 Snort IDS alert for network traffic 2->59 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 10 other signatures 2->65 10 fcoFomyM6G.exe 5 2->10         started        signatures3 process4 signatures5 75 Found many strings related to Crypto-Wallets (likely being stolen) 10->75 13 fcoFomyM6G.exe 13 10->13         started        process6 dnsIp7 47 orgstekomnw.pw 172.67.144.5, 49713, 49714, 49715 CLOUDFLARENETUS United States 13->47 49 toolstechs.com 141.95.126.90, 443, 49752, 49753 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 13->49 41 C:\Users\user\...\ffokrmpxnanvcvovqid.exe, PE32 13->41 dropped 77 Query firmware table information (likely to detect VMs) 13->77 79 Found many strings related to Crypto-Wallets (likely being stolen) 13->79 81 Tries to harvest and steal browser information (history, passwords, etc) 13->81 18 ffokrmpxnanvcvovqid.exe 4 13->18         started        22 cmd.exe 1 13->22         started        file8 signatures9 process10 file11 39 C:\ProgramData\SMUCCI\YKM.exe, PE32 18->39 dropped 67 Multi AV Scanner detection for dropped file 18->67 69 Query firmware table information (likely to detect VMs) 18->69 71 Tries to detect virtualization through RDTSC time measurements 18->71 73 2 other signatures 18->73 24 cmd.exe 1 18->24         started        26 conhost.exe 22->26         started        28 timeout.exe 1 22->28         started        30 fsutil.exe 1 22->30         started        signatures12 process13 process14 32 YKM.exe 2 24->32         started        35 conhost.exe 24->35         started        37 timeout.exe 1 24->37         started        signatures15 51 Multi AV Scanner detection for dropped file 32->51 53 Query firmware table information (likely to detect VMs) 32->53 55 Tries to detect sandboxes and other dynamic analysis tools (window names) 32->55 57 3 other signatures 32->57
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6aa024e2681961c93d29f8600baa935b545e274db48eb832de1f3dea17db546/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2023-10-08 10:05:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
17 of 36 (47.22%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w2vaetrgqglbze6st6dabovjgw2ulytu3neoxazn4hz55il5wvda._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion spyware stealer themida trojan vmprotect
Link:
https://tria.ge/reports/231010-x8yf4aac77/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Deletes itself
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
VMProtect packed file
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
fd56a07f2da75c84337cbf94e0acafc09fb909cfb187a0ae214827ce2c4708bb
MD5 hash:
d93c5f59ddc41313bf36f106a2f1fe17
SHA1 hash:
97c5cd9d0689c1cd74685bc979122a13eba3fcc9
Link:
https://www.unpac.me/results/3fd7ed6b-e027-496a-9e43-fe9afe8f96fe/
SH256 hash:
f45e1c1d1c14dd7cdb42da297d83244bd06cb8c576a76b5a14f3b0d6f83772c8
MD5 hash:
143853bb0cfe54fc4021e27e3ecdb39c
SHA1 hash:
1c808faccc7a5965e95194be12a557716316610d
Detections:
win_lumma_auto
Create hunting rule
Link:
https://www.unpac.me/results/3fd7ed6b-e027-496a-9e43-fe9afe8f96fe/
SH256 hash:
b6aa024e2681961c93d29f8600baa935b545e274db48eb832de1f3dea17db546
MD5 hash:
5230300086eca8ba0698f2b8d10c0686
SHA1 hash:
7e5da59abc430b41183e5e1b3948c0bc39c402bb
Link:
https://www.unpac.me/results/3fd7ed6b-e027-496a-9e43-fe9afe8f96fe/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with unregistered version of .NET Reactor
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_lumma_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lumma.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/452987/

Comments