MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be03d283d7eba7aac1c4aca040ef3368b2a25d9d953ee56ab83561c4491e11a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be03d283d7eba7aac1c4aca040ef3368b2a25d9d953ee56ab83561c4491e11a3
SHA3-384 hash: 9cfbf9ac8392b811476ee27e09818ff35c90ec4d68925255f82498a0670703d218d358f72e7c22e06f1da6f0dce0f2d2
SHA1 hash: b27c5860de8c7c14318ef307580012b899a91cfc
MD5 hash: 6a66f6493bb2ade679ed5f665161b8d2
humanhash: texas-yellow-white-sodium
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'988'032 bytes
First seen:2024-10-23 10:33:18 UTC
Last seen:2024-10-23 11:51:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:amofjJZ9xMNrdWzrI9i7INYGeaAi1hbqUpEG9sodLfg7pQPCF5TvCAE:amofjJZ9WNroX7cWGeaAihbqUb9sodLJ
Threatray 242 similar samples on MalwareBazaar
TLSH T116D53A93F505B6CBD48E23758567CD42AA6D43F90B1409E3E8AC68BDBD63CC122F6D24
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: http://185.215.113.16/luma/random.exe

Intelligence

File Origin
# of uploads :
21
# of downloads :
395
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-10-23 10:35:17 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/48282382-c445-429b-b727-8d93b576ec9a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.30753.3678.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6718d24b9e67c246820375f1
Tags:
Shellcode
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Behavior that indicates a threat
DNS request
Connection attempt
Sending a custom TCP request
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed packer_detected
Link:
https://www.filescan.io/uploads/6718d11cd875ce8b57d75d69/reports/bcf6352e-50de-4d72-9846-7d7cfc5fccb1/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/be03d283d7eba7aac1c4aca040ef3368b2a25d9d953ee56ab83561c4491e11a3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7f222c96-d4ee-43d4-9b3a-6515a8e9fc38
Result
Threat name:
LummaC, Amadey, Credential Flusher, Lumm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1540085
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Excessive usage of taskkill to terminate processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1540085 Sample: file.exe Startdate: 23/10/2024 Architecture: WINDOWS Score: 100 94 studennotediw.store 2->94 96 steamcommunity.com 2->96 98 11 other IPs or domains 2->98 112 Suricata IDS alerts for network traffic 2->112 114 Found malware configuration 2->114 116 Antivirus detection for dropped file 2->116 118 16 other signatures 2->118 9 file.exe 3 2->9         started        14 skotes.exe 4 25 2->14         started        16 85dbe0e712.exe 2->16         started        18 5 other processes 2->18 signatures3 process4 dnsIp5 100 sergei-esenin.com 172.67.206.204, 443, 49712, 49713 CLOUDFLARENETUS United States 9->100 102 steamcommunity.com 104.102.49.254, 443, 49711, 49999 AKAMAI-ASUS United States 9->102 104 185.215.113.16, 49771, 49997, 50000 WHOLESALECONNECTIONSNL Portugal 9->104 76 C:\...\UTIPZIWAUPAII75SDI4NATH3AFOZYJP.exe, PE32 9->76 dropped 78 C:\Users\...\I33UNVCVAD2YFFZW9YR5O28GNHYN.exe, PE32 9->78 dropped 80 C:\Users\user\...\HR00UVARPC2LBJGH.exe, PE32 9->80 dropped 152 Query firmware table information (likely to detect VMs) 9->152 154 Found many strings related to Crypto-Wallets (likely being stolen) 9->154 156 Tries to evade debugger and weak emulator (self modifying code) 9->156 172 3 other signatures 9->172 20 UTIPZIWAUPAII75SDI4NATH3AFOZYJP.exe 4 9->20         started        24 HR00UVARPC2LBJGH.exe 9 1 9->24         started        26 I33UNVCVAD2YFFZW9YR5O28GNHYN.exe 13 9->26         started        106 185.215.113.43, 49995, 49996, 49998 WHOLESALECONNECTIONSNL Portugal 14->106 82 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 14->82 dropped 84 C:\Users\user\AppData\...\35930defbb.exe, PE32 14->84 dropped 92 6 other malicious files 14->92 dropped 158 Creates multiple autostart registry keys 14->158 174 2 other signatures 14->174 29 9b658a64d1.exe 14->29         started        31 85dbe0e712.exe 14->31         started        33 35930defbb.exe 14->33         started        35 num.exe 14->35         started        86 C:\Users\user\...\KSJ9D3G4TG9J9BG342.exe, PE32 16->86 dropped 88 C:\Users\...\BM6X6N91Q825OL56L79B3D4PYF.exe, PE32 16->88 dropped 90 C:\Users\...\52PTCAVK2WV3XP7OVI2XNCL41K.exe, PE32 16->90 dropped 160 Tries to harvest and steal ftp login credentials 16->160 162 Tries to harvest and steal browser information (history, passwords, etc) 16->162 164 Tries to steal Crypto Currency Wallets 16->164 166 Antivirus detection for dropped file 18->166 168 Detected unpacking (changes PE section rights) 18->168 170 Binary is likely a compiled AutoIt script file 18->170 176 2 other signatures 18->176 37 firefox.exe 18->37         started        39 4 other processes 18->39 file6 signatures7 process8 dnsIp9 74 C:\Users\user\AppData\Local\...\skotes.exe, PE32 20->74 dropped 120 Antivirus detection for dropped file 20->120 122 Detected unpacking (changes PE section rights) 20->122 124 Machine Learning detection for dropped file 20->124 126 Potentially malicious time measurement code found 20->126 41 skotes.exe 20->41         started        128 Multi AV Scanner detection for dropped file 24->128 130 Modifies windows update settings 24->130 140 3 other signatures 24->140 108 185.215.113.37, 49838, 50002, 80 WHOLESALECONNECTIONSNL Portugal 26->108 142 2 other signatures 26->142 132 Tries to detect sandboxes and other dynamic analysis tools (window names) 29->132 144 2 other signatures 29->144 134 Binary is likely a compiled AutoIt script file 33->134 136 Excessive usage of taskkill to terminate processes 33->136 44 taskkill.exe 33->44         started        46 taskkill.exe 33->46         started        48 taskkill.exe 33->48         started        56 9 other processes 33->56 110 127.0.0.1 unknown unknown 37->110 138 Found many strings related to Crypto-Wallets (likely being stolen) 37->138 50 firefox.exe 37->50         started        52 conhost.exe 39->52         started        54 conhost.exe 39->54         started        58 2 other processes 39->58 file10 signatures11 process12 signatures13 146 Hides threads from debuggers 41->146 148 Tries to detect sandboxes / dynamic malware analysis system (registry check) 41->148 150 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 41->150 60 conhost.exe 44->60         started        62 conhost.exe 46->62         started        64 conhost.exe 48->64         started        66 conhost.exe 56->66         started        68 conhost.exe 56->68         started        70 conhost.exe 56->70         started        72 4 other processes 56->72 process14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/be03d283d7eba7aac1c4aca040ef3368b2a25d9d953ee56ab83561c4491e11a3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be03d283d7eba7aac1c4aca040ef3368b2a25d9d953ee56ab83561c4491e11a3/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2024-10-23 10:34:06 UTC
File Type:
PE (Exe)
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xyb5fa6x5ot2vqoevsqeb3ztnczkexm5su7ok2vygvq4isi6cgrq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
08643496ffbec35a84e902dbdbfe27b8b1043d66627dec62d3c6a2f0de76111c
LummaStealer
32437a843db147563e28256279e435eb7a2dbc92d510f8fbf0375fb9111070a1
LummaStealer
744beafe8406a4c3536f2d84de8484deff8232391b17c994c1034494035d6950
LummaStealer
8eb064e3306fcaa33fa6b9e5cab91001de88a9e207208abc67eac98a526e4b4c
LummaStealer
ab9b3c2e96eb0eb2eea2018eba01011fdfbb4e38cb1c0e87b799705fa7098d5c
LummaStealer
c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305
LummaStealer
c7c24e8887dd978f70cfce8e2e5f449b49de0012d8cbdfce51c0227cffe94cb7
LummaStealer
cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4
LummaStealer
da04996a87142ebbfd548a3ec20bbf83fbda45af8a7e41ffea51dfac653e60cf
LummaStealer
error
LummaStealer
fc5d6968d1431b37238deb56912780265889ee2afb055d5dd89a4f2e4961f57d
LummaStealer
+ 232 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:lumma family:stealc botnet:9c9aa5 botnet:doma discovery evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/241023-ml4dqaxbnm/
Behaviour
Checks processor information in registry
Kills process with taskkill
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Lumma Stealer, LummaC
Modifies Windows Defender Real-time Protection settings
Stealc
Malware Config
C2 Extraction:
https://clearancek.site
https://licendfilteo.site
https://spirittunek.store
https://bathdoomgaz.store
https://studennotediw.store
https://dissapoiznw.store
https://eaglepawnoy.store
https://mobbipenju.store
http://185.215.113.43
http://185.215.113.37
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/24052caf-19e3-4997-93c5-b7e1e817bb65
Unpacked files
SH256 hash:
92af2db53af0f5e8bd765daf6b6e793097413aa9aab1f4ddaa7e6ca8ad6211d0
MD5 hash:
51e902e8917e9c69d8572c5248e6ded3
SHA1 hash:
fe75bca49a53666887ad14529bee63d5c79aa4bb
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/9e226a5c-5c41-4fa3-884c-fb44c8ee2f63/
SH256 hash:
be03d283d7eba7aac1c4aca040ef3368b2a25d9d953ee56ab83561c4491e11a3
MD5 hash:
6a66f6493bb2ade679ed5f665161b8d2
SHA1 hash:
b27c5860de8c7c14318ef307580012b899a91cfc
Link:
https://www.unpac.me/results/9e226a5c-5c41-4fa3-884c-fb44c8ee2f63/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be03d283d7eba7aac1c4aca040ef3368b2a25d9d953ee56ab83561c4491e11a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe be03d283d7eba7aac1c4aca040ef3368b2a25d9d953ee56ab83561c4491e11a3

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3245480/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments