MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 10 File information Comments

SHA256 hash:	c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f
SHA3-384 hash:	fc8f50f452f1123786e991391d1b0498496716dfee8237a27e27681ddbed93f20dc6d8ca7494a544ffc9fca91dea7386
SHA1 hash:	8c04dcaf25dde9d33f36f7e4200b799001f4b913
MD5 hash:	9e41fbe1faa9be3423ddb2436ddec81c
humanhash:	helium-speaker-alaska-washington
File name:	ASmartService.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	4'222'568 bytes
First seen:	2024-11-13 15:49:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7c9f911b7ab0f8b0e1212497048ba2aa (1 x LummaStealer)
ssdeep	49152:7MuwhuP83/7Ozk72l/hS2OYXd6jGx99/6LpqWtBe/SaU8R:1wH/uka5hS1YXdpiLpRBe/Sa
TLSH	T108168F312AF0D172D27336308A795379A67AB7305B3982CF52D10E3E29B45D29D3876B
TrID	68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.5% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	ramirezrick2
Tags:	exe lumma LummaStealer

ramirezrick2

https://tria.ge/241113-s1ypnsvbpa/behavioral1

Intelligence

File Origin

# of uploads :

# of downloads :

634

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ASmartService.exe

Verdict:

Malicious activity

Analysis date:

2024-11-13 15:50:55 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/9407c6a5-dbe9-4d3e-952e-f020758b715b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67351ad80552fd58596bba4e

Tags:

dropper virus gates

Result

Verdict:

Clean

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm crypto explorer fingerprint installer keylogger lolbin microsoft_visual_cc overlay

Link:

https://www.filescan.io/uploads/6734caac0448e79357510924/reports/4342a485-4595-4032-84b2-a6fcd940b3c5/overview

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/82504953-2c53-4559-b7a4-565f9ffe6fc8

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1555266

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Malicious sample detected (through community Yara rule)

Query firmware table information (likely to detect VMs)

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

88%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zbiximc3oosqyi3uf27gnovomsbaybfowsg6d727vp7qjf4ytzxq._file

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/241113-s9w77svepl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Browser Information Discovery

System Location Discovery: System Language Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://giftedbonus.cyou/api

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/d675636d-d6cf-43aa-bae4-232531b5fa23

Unpacked files

SH256 hash:

c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f

MD5 hash:

9e41fbe1faa9be3423ddb2436ddec81c

SHA1 hash:

8c04dcaf25dde9d33f36f7e4200b799001f4b913

Link:

https://www.unpac.me/results/b91287fc-cfe8-402b-83bf-709eb52416a3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Checking for malicious import combination that common Ransomware mostly use

Rule name:	without_attachments Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any attachment
Reference:	http://laboratorio.blogs.hispasec.com/

Rule name:	without_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any url
Reference:	http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

zip a4dfd502c80fa63474972608e27e62f4c71d24f8779a23cc444dad63cc2dbc3c

LummaStealer

exe c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f

(this sample)

Link

https://www.virustotal.com/gui/file/c85174305b73a50c23742ebe66baae64820c04aeb48de1ff5fabff0497989e6f

Dropped by

SHA256 a4dfd502c80fa63474972608e27e62f4c71d24f8779a23cc444dad63cc2dbc3c

Delivery method

Distributed via web download

Dropped by

MD5 12fb2c87aabee09581c00cd31ee704cd

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::CopySid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetSidLengthRequired ADVAPI32.dll::GetSidSubAuthority ADVAPI32.dll::InitializeSid ADVAPI32.dll::IsValidSid
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipDeleteGraphics gdiplus.dll::GdipAlloc gdiplus.dll::GdipCreateFromHDC
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::PlaySoundW WINMM.dll::waveOutClose WINMM.dll::waveOutGetDevCapsW WINMM.dll::waveOutGetErrorTextW WINMM.dll::waveOutGetNumDevs WINMM.dll::waveOutOpen
RPC_API	Can Execute Remote Procedures	RPCRT4.dll::RpcStringFreeW
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorControl ADVAPI32.dll::GetSecurityDescriptorDacl ADVAPI32.dll::GetSecurityDescriptorGroup
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetConsoleCtrlHandler KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW SHLWAPI.dll::PathRemoveFileSpecW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW ADVAPI32.dll::LookupPrivilegeValueW
WIN_CRYPT_API	Uses Windows Crypt API	ADVAPI32.dll::CryptAcquireContextW ADVAPI32.dll::CryptCreateHash ADVAPI32.dll::CryptGetHashParam ADVAPI32.dll::CryptHashData
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegCreateKeyW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueW ADVAPI32.dll::RegQueryValueExW
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::ChangeServiceConfig2W ADVAPI32.dll::ChangeServiceConfigW ADVAPI32.dll::ControlService ADVAPI32.dll::CreateServiceW ADVAPI32.dll::OpenSCManagerW ADVAPI32.dll::OpenServiceW
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::CreateMenu ole32.dll::OleCreateMenuDescriptor USER32.dll::EmptyClipboard USER32.dll::OpenClipboard USER32.dll::PeekMessageW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample