MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec
SHA3-384 hash: 4e1ebd366e756650cc26ddd16de548243d6391db93964fce384de4773898ee360973619d2eb5f6b8b987c2aa9de62f14
SHA1 hash: 8ad929d49ecfe967a0275b89ed2357ce78adbf76
MD5 hash: da53a350713a3acd92f0ecbf2983999c
humanhash: four-monkey-nevada-blossom
File name:da53a350713a3acd92f0ecbf2983999c.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'318'400 bytes
First seen:2024-10-16 06:38:04 UTC
Last seen:2024-10-16 07:58:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2927377c817d8ecf7304e8505e1e4f5f (13 x LummaStealer)
ssdeep 12288:cO1+r+pqWeWFOZHeBbyse8xe5r9xfjmm6ZW09bFUGloLkpsyQNZ:ckI+poQez8x89ZjcwGblloLslQN
TLSH T1C7550216B5C0C5F2E9B2093201A0AA66977EFD300F206D9F77D8467E9F301D1692AC6F
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
384
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
da53a350713a3acd92f0ecbf2983999c.exe
Verdict:
Suspicious activity
Analysis date:
2024-10-16 08:12:47 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/6fd63a10-b6b7-47fb-a527-c7e021cfb8c9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.DownLoader47.45193.2548.27420.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=670f5f8a1d4ef219fa633d83
Tags:
Malware
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/670f5f88a74d65ea898c4de7/reports/2bd04f9b-f283-4f05-bfe9-61ebbdef24fd/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec
Malware family:
LummaC2 Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/144e4703-b8d1-4864-be5e-f6e8e3a93a0b
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1534832
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
LummaC encrypted strings found
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1534832 Sample: h8QAwvZTAh.exe Startdate: 16/10/2024 Architecture: WINDOWS Score: 100 16 Found malware configuration 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 6 other signatures 2->22 6 h8QAwvZTAh.exe 2->6         started        process3 process4 8 h8QAwvZTAh.exe 6->8         started        10 h8QAwvZTAh.exe 6->10         started        12 h8QAwvZTAh.exe 6->12         started        14 36 other processes 6->14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zgyxmpangirghojxqpbjnw4csgjr7lps7uk2scfatdsw2vwc37wa._file
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/241016-hd31rssank/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Lumma Stealer, LummaC
Malware Config
C2 Extraction:
https://drawwyobstacw.sbs
https://condifendteu.sbs
https://ehticsprocw.sbs
https://vennurviot.sbs
https://resinedyw.sbs
https://enlargkiw.sbs
https://allocatinow.sbs
https://mathcucom.sbs
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0f602ff6-383c-4807-985d-09492493d6a4
Unpacked files
SH256 hash:
84033def9ffa70c7b77ce9a7f6008600c0145c28fe5ea0e56dfafd8474fb8176
MD5 hash:
1b9dfd4cb7f0414950c80a4e0ed96329
SHA1 hash:
95dede154fe7e31fea0bfca069c9d0ab686d41da
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/376160de-2a73-4e95-a552-73d0f28239c7/
Parent samples :
cf102d7610f28529062646e721700d614f678989b04d22940bf3668da85c7931
e855881aa09ecd170bcbfb7f01f7306f765e0f3ed9fcd1cdf7282194023d11a4
38e97888ba4afeb7d201899983232093d618faae2a97bc860950c6bd63d6eecd
5c5140ec6f89d970f01c6a851784dbe9b8111a0a9bec83febb14808e564e7a9b
442a7999587b1912249170b3dcd69912563acb90dc252b67e8a6975677eb9616
402c5b4c3bc5504d50341852022370820b63f6e7ce7ba256f5d267b0b17b13ff
c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec
abfd6c2faaf0282b9aaccf76d62dd1d50c214aa61574a8a7fdaa0f263bb5b22c
65be512fec6fba2f8acf5859479fa200390bd96127e63d19846882385506f8d1
9793985587748f37b6695a12f3556d7f08cda565050478400151263d3cf5adaa
7cb6c4c633f649b1d59c5d0eb9782b40424c2b363772ec968c81d4902faf7a49
a916aaf05a06f21118822dfbc1bea35906bf2cb4ef2dce7bd3c320a45d2f4bef
1102be9e88e489cad3eefcd8a5671dedd10c261cceab465980d859efabb2c36d
a3959af369ca057024a912c494a466ec9fa8797f4829929bb8193ecbdd9e383e
5e775466410e42985d4d55a0043a7656cba3f4f6af11805d759e6a01f8f0af45
8843020b70dba72962910280a22ebdbd1a5f6a0fc50372509d3dc752443dfccd
eea8b75e3c8715b5b6693c320da19eff9a2eacef27e1565cbef68095bd3a98a1
cfee6bf7339c11e2ac0ed9a2c47d18d2fea7966b2d01fc79b4b4847dca6c4d85
d09e0c469a05b335bb50e5b15a4e203f6cf029e528a3065cc7dff9c5807ded05
253867c7c0ff443f04fc3b9c9d5cc0eb7c1d9d94c1560bdac29a1666befb36e8
SH256 hash:
c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec
MD5 hash:
da53a350713a3acd92f0ecbf2983999c
SHA1 hash:
8ad929d49ecfe967a0275b89ed2357ce78adbf76
Link:
https://www.unpac.me/results/376160de-2a73-4e95-a552-73d0f28239c7/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c9b1763c0d32/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe c9b1763c0d322263b93783c296db8291931fadf2fd15a908a098e56d56c2dfec

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3235677/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments