MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 18


Intelligence 18 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305
SHA3-384 hash: a6ad337677295bfac931db9cf05543de8e203aa343bc40371ca689dc957b3fe945adec8d24de73b16e5d5fb4dd8eb74b
SHA1 hash: 1f27a8a64da9ab465c0615a966bcb0cc3be1d52c
MD5 hash: 1a5cb26c201f8c7233b609883251e716
humanhash: neptune-kilo-shade-fanta
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'931'712 bytes
First seen:2024-10-21 20:46:48 UTC
Last seen:2024-10-21 21:36:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:CnbtqzYK0udFgPkTJuIds8q4e2FyYVrJEf0JLMzkSCZm75fyOG:opaYK0IgPkTJuI3q4e0zDhZmlfe
Threatray 253 similar samples on MalwareBazaar
TLSH T181D54BE2652572CFE88E2A74D5A7CD82685D47F94F3248C3987DB4BBAD63CC011B5C28
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: http://185.215.113.16/luma/random.exe

Intelligence

File Origin
# of uploads :
19
# of downloads :
432
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-10-21 20:49:41 UTC
Tags:
lumma stealer loader stealc amadey botnet
Link:
https://app.any.run/tasks/3e59f526-9b62-4dc8-8c74-d823cdc4ecae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.27799.346.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6716bdce9e67c2468202e356
Tags:
Powershell Vmdetect Autorun Spam
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Behavior that indicates a threat
DNS request
Connection attempt
Sending a custom TCP request
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm anti-vm evasive fingerprint packed packed packer_detected
Link:
https://www.filescan.io/uploads/6716bdca718466003853408d/reports/b3a55057-c5be-4519-ae8b-d636f1e0cadc/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/fec5b450-b686-41b1-86ca-43611f0b9f2a
Result
Threat name:
LummaC, Amadey, Credential Flusher, Lumm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1538879
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Found API chain indicative of sandbox detection
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1538879 Sample: file.exe Startdate: 21/10/2024 Architecture: WINDOWS Score: 100 117 studennotediw.store 2->117 119 steamcommunity.com 2->119 121 44 other IPs or domains 2->121 139 Suricata IDS alerts for network traffic 2->139 141 Found malware configuration 2->141 143 Antivirus detection for URL or domain 2->143 145 18 other signatures 2->145 10 skotes.exe 2->10         started        15 file.exe 3 2->15         started        17 cde283fd91.exe 2->17         started        19 4 other processes 2->19 signatures3 process4 dnsIp5 123 185.215.113.43, 49763, 49771, 49773 WHOLESALECONNECTIONSNL Portugal 10->123 99 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 10->99 dropped 101 C:\Users\user\AppData\...\1bf7a5f657.exe, PE32 10->101 dropped 115 4 other malicious files 10->115 dropped 189 Creates multiple autostart registry keys 10->189 191 Hides threads from debuggers 10->191 193 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->193 21 cde283fd91.exe 10->21         started        25 1bf7a5f657.exe 10->25         started        27 num.exe 10->27         started        125 sergei-esenin.com 172.67.206.204, 443, 49707, 49708 CLOUDFLARENETUS United States 15->125 127 steamcommunity.com 104.102.49.254, 443, 49706, 49775 AKAMAI-ASUS United States 15->127 129 185.215.113.16, 49716, 49772, 49774 WHOLESALECONNECTIONSNL Portugal 15->129 103 C:\Users\user\...\M9GELPGX094PZYT0ADMTTT.exe, PE32 15->103 dropped 105 C:\...\CI190686V0IUCF8Y8AMREI3F0UHYK.exe, PE32 15->105 dropped 107 C:\Users\user\...\9VVL03AA0BMC81PWP.exe, PE32 15->107 dropped 195 Query firmware table information (likely to detect VMs) 15->195 197 Found many strings related to Crypto-Wallets (likely being stolen) 15->197 199 Tries to evade debugger and weak emulator (self modifying code) 15->199 209 2 other signatures 15->209 29 9VVL03AA0BMC81PWP.exe 4 15->29         started        31 CI190686V0IUCF8Y8AMREI3F0UHYK.exe 13 15->31         started        34 M9GELPGX094PZYT0ADMTTT.exe 15->34         started        109 C:\Users\...\ZEAF13UXY4BPNRJ6YYGZLOIP6XJ.exe, PE32 17->109 dropped 111 C:\...\R9212TWV8EP5NLR4A7WC26NO5F01F34.exe, PE32 17->111 dropped 113 C:\Users\...\HR5NMA4UR7H3JECW1QGQ4ZL4MBOJ.exe, PE32 17->113 dropped 201 Tries to harvest and steal ftp login credentials 17->201 203 Tries to harvest and steal browser information (history, passwords, etc) 17->203 205 Tries to steal Crypto Currency Wallets 17->205 36 ZEAF13UXY4BPNRJ6YYGZLOIP6XJ.exe 17->36         started        207 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 19->207 38 firefox.exe 19->38         started        40 firefox.exe 19->40         started        file6 signatures7 process8 dnsIp9 89 C:\Users\...\UOPLXRKJO7XHJUUIUDANT7ZJJH.exe, PE32 21->89 dropped 91 C:\Users\user\...91WKNNOAHGPX6PMV84VFZ.exe, PE32 21->91 dropped 147 Antivirus detection for dropped file 21->147 149 Multi AV Scanner detection for dropped file 21->149 151 Query firmware table information (likely to detect VMs) 21->151 169 2 other signatures 21->169 42 UOPLXRKJO7XHJUUIUDANT7ZJJH.exe 21->42         started        45 NWKNNOAHGPX6PMV84VFZ.exe 21->45         started        93 C:\Users\user\AppData\Local\...\skotes.exe, PE32 29->93 dropped 153 Detected unpacking (changes PE section rights) 29->153 155 Machine Learning detection for dropped file 29->155 157 Tries to evade debugger and weak emulator (self modifying code) 29->157 159 Tries to detect virtualization through RDTSC time measurements 29->159 47 skotes.exe 29->47         started        131 185.215.113.37, 49717, 49781, 49785 WHOLESALECONNECTIONSNL Portugal 31->131 161 Hides threads from debuggers 31->161 171 2 other signatures 31->171 163 Binary is likely a compiled AutoIt script file 34->163 165 Found API chain indicative of sandbox detection 34->165 49 taskkill.exe 1 34->49         started        51 taskkill.exe 1 34->51         started        53 taskkill.exe 1 34->53         started        57 3 other processes 34->57 167 Tries to detect sandboxes and other dynamic analysis tools (window names) 36->167 133 youtube.com 142.250.181.238, 443, 49726, 49727 GOOGLEUS United States 38->133 135 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49728, 49735, 49738 GOOGLEUS United States 38->135 137 10 other IPs or domains 38->137 95 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 38->95 dropped 97 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 38->97 dropped 55 firefox.exe 38->55         started        59 2 other processes 38->59 file10 signatures11 process12 signatures13 173 Multi AV Scanner detection for dropped file 42->173 175 Tries to evade debugger and weak emulator (self modifying code) 42->175 177 Hides threads from debuggers 42->177 179 Binary is likely a compiled AutoIt script file 45->179 61 taskkill.exe 45->61         started        63 taskkill.exe 45->63         started        65 taskkill.exe 45->65         started        77 3 other processes 45->77 181 Antivirus detection for dropped file 47->181 183 Detected unpacking (changes PE section rights) 47->183 185 Machine Learning detection for dropped file 47->185 187 2 other signatures 47->187 67 conhost.exe 49->67         started        69 conhost.exe 51->69         started        71 conhost.exe 53->71         started        73 conhost.exe 57->73         started        75 conhost.exe 57->75         started        process14 process15 79 conhost.exe 61->79         started        81 conhost.exe 63->81         started        83 conhost.exe 65->83         started        85 conhost.exe 77->85         started        87 conhost.exe 77->87         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305/
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2024-10-21 20:47:12 UTC
File Type:
PE (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yejgo7vtlo3q37nwa6iog5rsbkbxabydsfa4skviswue65yj4mcq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
01be1f6d74db8b1f9e73c5f0261e4412dcdc21a6d59b7c07925a4c26cbbc6860
LummaStealer
0785ad7bb7e17f18665229dc9a772fae8d074c58f8cff680ab848f396bd952f9
LummaStealer
32437a843db147563e28256279e435eb7a2dbc92d510f8fbf0375fb9111070a1
LummaStealer
744beafe8406a4c3536f2d84de8484deff8232391b17c994c1034494035d6950
LummaStealer
9108d11c01d471075430db40318c8a315834f2c4a42666873918e677254aadb4
LummaStealer
c7c24e8887dd978f70cfce8e2e5f449b49de0012d8cbdfce51c0227cffe94cb7
LummaStealer
cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4
LummaStealer
da04996a87142ebbfd548a3ec20bbf83fbda45af8a7e41ffea51dfac653e60cf
LummaStealer
error
LummaStealer
f4995b1d057c8e9874d5f85cfa25bca71ff44a4141da6903c7e30f518728596f
LummaStealer
f911cd5b49dfd210d30323cb1975b05eb9e98659ce4776153a4f86956ac59105
LummaStealer
+ 243 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:lumma family:stealc botnet:9c9aa5 botnet:doma discovery evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/241021-zkvfmsvgmd/
Behaviour
Checks processor information in registry
Kills process with taskkill
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Lumma Stealer, LummaC
Stealc
Malware Config
C2 Extraction:
https://clearancek.site
https://licendfilteo.site
https://spirittunek.store
https://bathdoomgaz.store
https://studennotediw.store
https://dissapoiznw.store
https://eaglepawnoy.store
https://mobbipenju.store
http://185.215.113.43
http://185.215.113.37
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6de23a09-3f82-4b5d-ab60-463f585eab41
Unpacked files
SH256 hash:
1b1329cfafc6a640d767e90ee3d49517b8bbbda13079c98e5b74783599109438
MD5 hash:
31534e50f668e1e1eba11f457a54ed4c
SHA1 hash:
38592209524e0be30b3c58715943f23a4d1509a7
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/cf49258b-f08a-4923-98e0-cdeae894ef5e/
SH256 hash:
c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305
MD5 hash:
1a5cb26c201f8c7233b609883251e716
SHA1 hash:
1f27a8a64da9ab465c0615a966bcb0cc3be1d52c
Link:
https://www.unpac.me/results/cf49258b-f08a-4923-98e0-cdeae894ef5e/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c112677eb35b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe c112677eb35bb70dfdb60790e376320a837007039141c92aa895a84f7709e305

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments