MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7a2d4deab33d14c5c0df61413662f9c025a289c61378a0cd660d0daf521a0ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7a2d4deab33d14c5c0df61413662f9c025a289c61378a0cd660d0daf521a0ce
SHA3-384 hash: 0fcda7a07be66c25a172a211b27d4c4675d7261c61b992e8b85ddeb93d04c2a09f87b0cf2edbac55a56b2535f2909eab
SHA1 hash: 015b62dc84aac30eadf2228fcc978d7a8adb2950
MD5 hash: c921001283ef83c22480a86838160329
humanhash: jig-lake-eighteen-apart
File name:c921001283ef83c22480a86838160329.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:38'726 bytes
First seen:2023-12-29 17:25:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3
TLSH T15C03D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9
TrID 42.6% (.EXE) Win32 Executable (generic) (4505/5/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
18.9% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
0.2% (.VXD) VXD Driver (29/21)
Reporter abuse_ch
Tags:exe LummaStealer


Avatar
abuse_ch
LummaStealer C2:
http://5.42.66.57/3886d2276f6914c4.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
350
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
c7a2d4deab33d14c5c0df61413662f9c025a289c61378a0cd660d0daf521a0ce.exe
Verdict:
Malicious activity
Analysis date:
2023-12-29 17:34:38 UTC
Tags:
loader smoke smokeloader
Link:
https://app.any.run/tasks/4e2935cf-4abb-4f5e-9baf-0a74237817d5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Jefpimb-10016846-0
Create hunting rule

Win.Packed.Razy-10016942-0
Create hunting rule

Win.Trojan.Razy-10017154-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Creating a file in the %AppData% subdirectories
Running batch commands
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed xpack
Link:
https://www.filescan.io/uploads/658f012bffafd83ebc9f6645/reports/deb43cb3-e8ba-4719-8de4-76a37c2efe98/overview
Verdict:
Malicious
Labled as:
Trojan.Heur.Generic
Link:
https://www.hybrid-analysis.com/sample/c7a2d4deab33d14c5c0df61413662f9c025a289c61378a0cd660d0daf521a0ce
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e4d7a695-79d3-4ae5-8a16-375254f3da65
Result
Threat name:
Glupteba, LummaC Stealer, Petite Virus,
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1368042
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops large PE files
Drops PE files to the startup folder
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found Tor onion address
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Sample uses string decryption to hide its real strings
System process connects to network (likely due to code injection or exploit)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
UAC bypass detected (Fodhelper)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Glupteba
Yara detected LummaC Stealer
Yara detected Petite Virus
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Stealc
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1368042 Sample: 6101XOxMbY.exe Startdate: 29/12/2023 Architecture: WINDOWS Score: 100 142 soupinterestoe.fun 2->142 144 smartpoliceax.website 2->144 146 23 other IPs or domains 2->146 170 Multi AV Scanner detection for domain / URL 2->170 172 Found malware configuration 2->172 174 Malicious sample detected (through community Yara rule) 2->174 176 22 other signatures 2->176 14 6101XOxMbY.exe 2->14         started        17 curbtji 2->17         started        signatures3 process4 signatures5 246 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 14->246 248 Maps a DLL or memory area into another process 14->248 250 Checks if the current machine is a virtual machine (disk enumeration) 14->250 19 explorer.exe 58 31 14->19 injected 252 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 17->252 254 Creates a thread in another existing process (thread injection) 17->254 process6 dnsIp7 148 185.215.113.68, 49711, 80 WHOLESALECONNECTIONSNL Portugal 19->148 150 5.42.65.125, 49715, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 19->150 152 10 other IPs or domains 19->152 108 C:\Users\user\AppData\Roaming\rbrbtji, PE32 19->108 dropped 110 C:\Users\user\AppData\Roaming\curbtji, PE32 19->110 dropped 112 C:\Users\user\AppData\Local\Temp465.exe, PE32 19->112 dropped 114 12 other files (6 malicious) 19->114 dropped 206 System process connects to network (likely due to code injection or exploit) 19->206 208 Benign windows process drops PE files 19->208 210 Found many strings related to Crypto-Wallets (likely being stolen) 19->210 212 2 other signatures 19->212 24 AEEB.exe 7 19->24         started        27 116.exe 19->27         started        31 7F9D.exe 4 19->31         started        33 4 other processes 19->33 file8 signatures9 process10 dnsIp11 126 C:\Users\user\AppData\Local\...\toolspub2.exe, PE32 24->126 dropped 128 C:\Users\user\AppData\Local\Temp\etopt.exe, PE32 24->128 dropped 130 C:\...\31839b57a4f11171d6abc8bbc4451ee4.exe, PE32 24->130 dropped 138 2 other files (none is malicious) 24->138 dropped 35 toolspub2.exe 24->35         started        38 tuc4.exe 24->38         started        41 31839b57a4f11171d6abc8bbc4451ee4.exe 24->41         started        52 4 other processes 24->52 154 5.42.65.31 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 27->154 132 C:\Users\user\AppData\Roaming\...\qemu-ga.exe, PE32 27->132 dropped 226 Detected unpacking (changes PE section rights) 27->226 228 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 27->228 230 Query firmware table information (likely to detect VMs) 27->230 244 7 other signatures 27->244 134 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 31->134 dropped 232 Writes to foreign memory regions 31->232 234 Allocates memory in foreign processes 31->234 236 Sample uses process hollowing technique 31->236 43 MSBuild.exe 8 4 31->43         started        136 C:\Users\user\AppData\...\iojmibhyhiws.exe, PE32+ 33->136 dropped 238 Tries to evade debugger and weak emulator (self modifying code) 33->238 240 Tries to steal Crypto Currency Wallets 33->240 242 Injects a PE file into a foreign processes 33->242 46 RegAsm.exe 33->46         started        48 RegSvcs.exe 33->48         started        50 iojmibhyhiws.exe 33->50         started        54 3 other processes 33->54 file12 signatures13 process14 dnsIp15 178 Detected unpacking (changes PE section rights) 35->178 200 2 other signatures 35->200 56 toolspub2.exe 35->56         started        116 C:\Users\user\AppData\Local\Temp\...\tuc4.tmp, PE32 38->116 dropped 59 tuc4.tmp 38->59         started        180 Detected unpacking (overwrites its own PE header) 41->180 182 UAC bypass detected (Fodhelper) 41->182 202 2 other signatures 41->202 61 cmd.exe 41->61         started        156 195.20.16.103, 20440, 49716 EITADAT-ASFI Finland 43->156 184 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 43->184 186 Found many strings related to Crypto-Wallets (likely being stolen) 43->186 188 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 43->188 158 20.79.30.95 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 46->158 190 Tries to steal Crypto Currency Wallets 46->190 160 soupinterestoe.fun 104.21.24.252 CLOUDFLARENETUS United States 48->160 192 Tries to harvest and steal browser information (history, passwords, etc) 48->192 194 Tries to evade debugger and weak emulator (self modifying code) 50->194 162 api4.ipify.org 64.185.227.156 WEBNXUS United States 52->162 164 91.92.254.7 THEZONEBG Bulgaria 52->164 166 3 other IPs or domains 52->166 118 C:\Users\user\AppData\...\nswDD7F.tmp.exe, PE32 52->118 dropped 120 C:\Windows\Panther\...120ppConverter.dll, PE32+ 52->120 dropped 122 C:\Users\user\AppData\Local\...\INetC.dll, PE32 52->122 dropped 124 6 other files (none is malicious) 52->124 dropped 196 Query firmware table information (likely to detect VMs) 52->196 198 Creates an undocumented autostart registry key 52->198 63 nswDD7F.tmp.exe 52->63         started        67 BroomSetup.exe 52->67         started        69 conhost.exe 54->69         started        71 conhost.exe 54->71         started        file16 signatures17 process18 dnsIp19 214 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 56->214 216 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 56->216 218 Maps a DLL or memory area into another process 56->218 224 2 other signatures 56->224 73 tuc4.exe 59->73         started        76 conhost.exe 61->76         started        78 fodhelper.exe 61->78         started        80 fodhelper.exe 61->80         started        168 5.42.66.57 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 63->168 92 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 63->92 dropped 94 C:\Users\user\AppData\...\softokn3[1].dll, PE32 63->94 dropped 96 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 63->96 dropped 98 9 other files (none is malicious) 63->98 dropped 220 Tries to harvest and steal ftp login credentials 63->220 222 Tries to harvest and steal browser information (history, passwords, etc) 63->222 file20 signatures21 process22 file23 140 C:\Users\user\AppData\Local\Temp\...\tuc4.tmp, PE32 73->140 dropped 82 tuc4.tmp 73->82         started        process24 file25 100 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 82->100 dropped 102 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 82->102 dropped 104 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 82->104 dropped 106 99 other files (none is malicious) 82->106 dropped 204 Drops large PE files 82->204 86 net.exe 82->86         started        signatures26 process27 process28 88 conhost.exe 86->88         started        90 net1.exe 86->90         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c7a2d4deab33d14c5c0df61413662f9c025a289c61378a0cd660d0daf521a0ce
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c7a2d4deab33d14c5c0df61413662f9c025a289c61378a0cd660d0daf521a0ce/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-12-23 23:15:59 UTC
File Type:
PE (Exe)
AV detection:
22 of 23 (95.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6rnjxvlgpiuyxan6ykbgzrptqbfuke4me3yudgwmdinv5jbudha._file
Verdict:
malicious
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:lumma family:redline family:smokeloader family:stealc family:zgrat botnet:livetraffic botnet:up3 backdoor dropper evasion infostealer loader rat stealer trojan
Link:
https://tria.ge/reports/231229-vzt17sedak/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Program crash
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Deletes itself
Executes dropped EXE
Downloads MZ/PE file
Modifies Windows Firewall
Detect Lumma Stealer payload V4
Detect ZGRat V1
Glupteba
Glupteba payload
Lumma Stealer
RedLine
RedLine payload
SmokeLoader
Stealc
ZGRat
Malware Config
C2 Extraction:
http://185.215.113.68/fks/index.php
20.79.30.95:13856
http://5.42.66.57
http://host-file-host6.com/
http://host-host-file8.com/
Unpacked files
SH256 hash:
c7a2d4deab33d14c5c0df61413662f9c025a289c61378a0cd660d0daf521a0ce
MD5 hash:
c921001283ef83c22480a86838160329
SHA1 hash:
015b62dc84aac30eadf2228fcc978d7a8adb2950
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/4189cb1b-e7a8-466d-95e7-db5cdab19ef4/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c7a2d4deab33/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.46
Link:
https://yomi.yoroi.company/submissions/c7a2d4deab33d14c5c0df61413662f9c025a289c61378a0cd660d0daf521a0ce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments