MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c19ab09c794ba5b102deb47330e3806380b6f547f8f84564ec17491087cb9fbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 8 File information Comments

SHA256 hash:	c19ab09c794ba5b102deb47330e3806380b6f547f8f84564ec17491087cb9fbb
SHA3-384 hash:	cf5a96f0998ce6612644eb469fc27ce6ee7041f044d0fdfd8bdc689b63ba773535515582a276d49ac9f3076da163583a
SHA1 hash:	6be83472e2c0827b15ec819788298bb21f35c00a
MD5 hash:	0f0da8c280a042a2d402eb0cd44118d6
humanhash:	fruit-comet-orange-skylark
File name:	boob.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	400'896 bytes
First seen:	2025-02-08 15:52:23 UTC
Last seen:	2025-02-08 16:26:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'233 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep	6144:Tux5lfopCjuxHCkCjiIFmZVNxNWU9kFXLcU1yeCkSjEgUQ+iGg0ZTYoe:45lwk4in2VfC9wAyNkQWQpGgqTYL
TLSH	T1C884020BABCB3B91C1A982F8D0E254194BF1A32F35B3E7033C9554665E25BC59F0BE91
TrID	66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.5% (.EXE) Win64 Executable (generic) (10522/11/4) 5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	aachum
Tags:	Amadey exe fed3aa LummaStealer

iamaachum

https://github.com/legendary6911331/hnhhhhhh/releases/download/slaldasladsladsl/boob.exe

Amadey C2: http://185.215.113.16/Jo89Ku7d/index.php
Amadey Botnet: fed3aa

Intelligence

File Origin

# of uploads :

# of downloads :

450

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

boob.exe

Verdict:

Malicious activity

Analysis date:

2025-02-08 15:55:34 UTC

Tags:

lumma stealer netreactor loader amadey botnet stealc cryptbot auto autoit telegram redline screenconnect remote lefthook credentialflusher rat asyncrat

Link:

https://app.any.run/tasks/90138113-99b6-40ff-99fc-080c961aac36

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Sanesecurity.Malware.30425.UnRegNetReactor.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Query of malicious DNS domain

Connection attempt to an infection source

Sending a TCP request to an infection source

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/c19ab09c794ba5b102deb47330e3806380b6f547f8f84564ec17491087cb9fbb

Malware family:

LummaC2 Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2432763d-b4db-4983-ba85-43962ec7f233

Result

Threat name:

LummaC Stealer, PureLog Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1610135

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected LummaC Stealer

Yara detected PureLog Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c19ab09c794ba5b102deb47330e3806380b6f547f8f84564ec17491087cb9fbb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c19ab09c794ba5b102deb47330e3806380b6f547f8f84564ec17491087cb9fbb/

Threat name:

ByteCode-MSIL.Trojan.LummaC

Status:

Malicious

First seen:

2025-02-05 16:22:15 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ygnlbhdzjos3caw6wrztby4amoaln5kh7d4ekzhmc5erbb6lt65q._file

Verdict:

malicious

Label(s):

lummastealer

amadey

Similar samples:

error

LummaStealer

Result

Malware family:

stealc

Score:

10/10

Tags:

family:amadey family:lumma family:stealc botnet:9c9aa5 botnet:fed3aa botnet:reno defense_evasion discovery persistence spyware stealer trojan

Link:

https://tria.ge/reports/250208-tbqs7stlgz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

.NET Reactor proctector

Checks BIOS information in registry

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Amadey

Amadey family

Lumma Stealer, LummaC

Lumma family

Stealc

Stealc family

Malware Config

C2 Extraction:

http://185.215.113.16
http://185.215.113.115
http://185.215.113.43
https://paleboreei.biz/api

Verdict:

Malicious

Tags:

c2 lumma_stealer lumma stealer

YARA:

n/a

Link:

https://app.threat.zone/submission/aa31ab86-ed26-4592-aa5c-60b7c99d72b9

Unpacked files

SH256 hash:

c19ab09c794ba5b102deb47330e3806380b6f547f8f84564ec17491087cb9fbb

MD5 hash:

0f0da8c280a042a2d402eb0cd44118d6

SHA1 hash:

6be83472e2c0827b15ec819788298bb21f35c00a

Link:

https://www.unpac.me/results/190a2ff6-448a-4abc-bd48-244dfa576646/

SH256 hash:

e94f57426f50479b464a50827f2bbcc28e25e4c49e47329ff7e8ca21b986817b

MD5 hash:

91a03cc6c9f393a2c18e12ac020ce4cc

SHA1 hash:

7e0d0fda12e3ff4c2e24256c924d1951b1cdcec9

Detections:

win_lumma_auto

LummaStealer

Link:

https://www.unpac.me/results/190a2ff6-448a-4abc-bd48-244dfa576646/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c19ab09c794b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Amadey

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c19ab09c794ba5b102deb47330e3806380b6f547f8f84564ec17491087cb9fbb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DotNet_Reactor Create hunting rule
Author:	@bartblaze
Description:	Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.

Rule name:	INDICATOR_EXE_Packed_DotNetReactor Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with unregistered version of .NET Reactor

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	PureCrypter Create hunting rule
Author:	@bartblaze
Description:	Identifies PureCrypter, .NET loader and obfuscator.
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe c19ab09c794ba5b102deb47330e3806380b6f547f8f84564ec17491087cb9fbb

(this sample)

Link

https://tria.ge/250208-s6rtbatjav

Dropped by

Amadey

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample