🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbb3aceb062c2955c28e2cb80f7b8d473504094b04708465e8f08810afa57dd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbb3aceb062c2955c28e2cb80f7b8d473504094b04708465e8f08810afa57dd1
SHA3-384 hash: 898d235abf857fed6415bfb8aa41fd326498b719fd1d9d7c0b1431895ce19a5dbe767b103ca4229ea4aa8f39b2cd69ee
SHA1 hash: b8f1472454647cf885d2c084e2b8a647bfc17737
MD5 hash: dd991c4fb06c114c0f09a61f9f6e1852
humanhash: bluebird-iowa-undress-chicken
File name:gFFvm8SLzB.ps1
Download: download sample
Signature LummaStealer
Create hunting rule
File size:683 bytes
First seen:2025-02-09 12:51:00 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12:jKMy26jInAkVF4QEkpRcA8HcLAuw+ew+hHIUw+LJ8/zu4hcLKASiTJQIP+7:jdy2lxV3EORciRkAUv4y4sKASWP4
Threatray 21 similar samples on MalwareBazaar
TLSH T19601232690A832A77AC4D1DF219894815AF12345621D342CB2B0AF3FC90A24853AECF7
Magika powershell
Reporter aachum
Tags:FakeCaptcha LummaStealer ps1


Avatar
iamaachum
https://fly.storage.tigris.dev/rzywzyfuion/ruba-furious-next-load.html => https://nopaste.net/gFFvm8SLzB

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
ES ES
Vendor Threat Intelligence
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67a8a5ae5ca88ce643b8262a
Tags:
obfuscate xtreme shell
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/bbb3aceb062c2955c28e2cb80f7b8d473504094b04708465e8f08810afa57dd1
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1610481
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for dropped file
Benign windows process drops PE files
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
Found Tor onion address
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: Suspicious PowerShell Parameter Substring
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected LummaC Stealer
Yara detected MSILLoadEncryptedAssembly
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1610481 Sample: gFFvm8SLzB.ps1 Startdate: 09/02/2025 Architecture: WINDOWS Score: 100 105 ditgitaldream.click 2->105 107 www.mediafire.com 2->107 109 7 other IPs or domains 2->109 129 Suricata IDS alerts for network traffic 2->129 131 Found malware configuration 2->131 133 Malicious sample detected (through community Yara rule) 2->133 135 15 other signatures 2->135 12 powershell.exe 15 2->12         started        15 KSHEICConverter.exe 2->15         started        17 KSHEICConverter.exe 2->17         started        19 3 other processes 2->19 signatures3 process4 dnsIp5 163 Suspicious powershell command line found 12->163 165 Found many strings related to Crypto-Wallets (likely being stolen) 12->165 167 Bypasses PowerShell execution policy 12->167 23 powershell.exe 15 16 12->23         started        27 conhost.exe 12->27         started        169 Maps a DLL or memory area into another process 15->169 171 Found direct / indirect Syscall (likely to bypass EDR) 15->171 29 choice.exe 15->29         started        32 choice.exe 17->32         started        111 127.0.0.1 unknown unknown 19->111 75 C:\Users\user\AppData\...\HDHelper.exe (copy), PE32 19->75 dropped 77 C:\Users\user\AppData\Roaming\...\BIT2DF4.tmp, PE32 19->77 dropped 173 Benign windows process drops PE files 19->173 175 Switches to a custom stack to bypass stack traces 19->175 34 choice.exe 19->34         started        file6 signatures7 process8 dnsIp9 119 download2434.mediafire.com 199.91.155.175, 443, 49738 MEDIAFIREUS United States 23->119 121 www.mediafire.com 104.17.150.117, 443, 49736 CLOUDFLARENETUS United States 23->121 123 connect-cdn-api.tastinessrebaterunny.shop 188.114.96.3, 443, 49731 CLOUDFLARENETUS European Union 23->123 153 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 23->153 155 Writes to foreign memory regions 23->155 157 Found suspicious powershell code related to unpacking or dynamic code loading 23->157 159 Injects a PE file into a foreign processes 23->159 36 MSBuild.exe 30 23->36         started        41 conhost.exe 23->41         started        95 C:\Users\user\AppData\Local\Temp\jhunvmiyda, PE32 29->95 dropped 161 Injects code into the Windows Explorer (explorer.exe) 29->161 43 explorer.exe 29->43         started        45 conhost.exe 29->45         started        97 C:\Users\user\AppData\Local\...\tpectoagnbgpj, PE32 32->97 dropped 47 conhost.exe 32->47         started        49 explorer.exe 32->49         started        51 conhost.exe 34->51         started        file10 signatures11 process12 dnsIp13 113 ditgitaldream.click 104.21.66.115, 443, 49740, 49741 CLOUDFLARENETUS United States 36->113 115 farmagrupodw.com 185.195.97.57, 443, 49748, 49749 ASPLES Spain 36->115 79 C:\Users\user\AppData\Local\...\vcomp140.dll, PE32+ 36->79 dropped 81 C:\Users\user\AppData\Local\...\msvcp140.dll, PE32+ 36->81 dropped 83 C:\Users\user\...\8CJPO40GEZB7TULMQ3M2T3R.exe, PE32 36->83 dropped 143 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 36->143 145 Query firmware table information (likely to detect VMs) 36->145 147 Found many strings related to Crypto-Wallets (likely being stolen) 36->147 151 3 other signatures 36->151 53 8CJPO40GEZB7TULMQ3M2T3R.exe 2 36->53         started        56 KSHEICConverter.exe 9 36->56         started        117 steamcommunity.com 104.102.49.254, 443, 50030, 50032 AKAMAI-ASUS United States 43->117 149 System process connects to network (likely due to code injection or exploit) 43->149 file14 signatures15 process16 file17 137 Maps a DLL or memory area into another process 53->137 139 Switches to a custom stack to bypass stack traces 53->139 141 Found direct / indirect Syscall (likely to bypass EDR) 53->141 59 choice.exe 3 53->59         started        85 C:\ProgramData\Debotnet\vcomp140.dll, PE32+ 56->85 dropped 87 C:\ProgramData\Debotnet\msvcp140.dll, PE32+ 56->87 dropped 89 C:\ProgramData\Debotnet\KSHEICConverter.exe, PE32+ 56->89 dropped 91 C:\ProgramData\...\JxmImageConvert2022.dll, PE32+ 56->91 dropped 63 KSHEICConverter.exe 1 56->63         started        signatures18 process19 file20 93 C:\Users\user\AppData\Local\Temp\uddysl, PE32 59->93 dropped 177 Found Tor onion address 59->177 179 Injects code into the Windows Explorer (explorer.exe) 59->179 181 Writes to foreign memory regions 59->181 187 2 other signatures 59->187 65 explorer.exe 1 59->65         started        69 conhost.exe 59->69         started        183 Maps a DLL or memory area into another process 63->183 185 Found direct / indirect Syscall (likely to bypass EDR) 63->185 71 choice.exe 63->71         started        signatures21 process22 dnsIp23 99 91.212.166.9, 49930, 50028, 50035 MOBILY-ASEtihadEtisalatCompanyMobilySA United Kingdom 65->99 101 91.212.166.91, 49927, 50027, 50034 MOBILY-ASEtihadEtisalatCompanyMobilySA United Kingdom 65->101 103 3 other IPs or domains 65->103 125 System process connects to network (likely due to code injection or exploit) 65->125 127 Switches to a custom stack to bypass stack traces 65->127 73 conhost.exe 71->73         started        signatures24 process25
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/bbb3aceb062c2955c28e2cb80f7b8d473504094b04708465e8f08810afa57dd1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbb3aceb062c2955c28e2cb80f7b8d473504094b04708465e8f08810afa57dd1/
Threat name:
Script-PowerShell.Trojan.Powdow
Create hunting rule
Status:
Malicious
First seen:
2025-02-09 12:04:07 UTC
File Type:
Text
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xoz2z2ygfquvlquofs4a664ni42qicklaryiizpi6cebbl5fpxiq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
3bcb2edbdb58b3f4b04b1629b76a7b91c22077e5d021599c22e8c0fb97483683
LummaStealer
3e6eeabe798170aa289466cf245b08e1236241650817e04b63fcf21ae7d9ced9
LummaStealer
4db98b32811e0daa01908ed57c890899315de8bf5a9baf120532423a80f80f44
LummaStealer
caf4b10a21b5f04dacde6d63508a7d37b7ae81d66a381e41be311c870d69a81b
LummaStealer
error
LummaStealer
ff602f4563cc458a8f3748ba637679be24980c534bb9d312243efd0ff4a68af2
LummaStealer
ff990e6b4e079e037ebae5a9fc969b48e9d10f49bbf9022a2b8d9aeae6e34f7c
LummaStealer
+ 11 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250209-p3l7wa1qdz/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bbb3aceb062c2955c28e2cb80f7b8d473504094b04708465e8f08810afa57dd1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

PowerShell (PS) ps1 bbb3aceb062c2955c28e2cb80f7b8d473504094b04708465e8f08810afa57dd1

(this sample)

LummaStealer

unknown 26b50b8585870303eddb861740732a276eb6a687c22d115fa57e760a30d0306c

LummaStealer

PowerShell (PS) ps1 9ee43d4d00df7ada267f9e618f8a4ada30d9fde440370e15513a32cb462e2b12

  
Link
https://tria.ge/250209-ptsy3a1jgk/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 9ee43d4d00df7ada267f9e618f8a4ada30d9fde440370e15513a32cb462e2b12
  
Dropping
MD5 83e15ee570b39ed83f6f7fe37a63de31

Comments


Avatar
Kasibe commented on 2025-02-09 12:56:28 UTC

CobaltStrike