MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4
SHA3-384 hash: 2845ba38633ae8c1f11f582448a4df120221789064db0b91dc3c057304c7e857b9b255c155b4bf9cca4dfa0f59fe1023
SHA1 hash: 43b98069916079f706be9822a5f866f91486e10e
MD5 hash: 2e919c1035fd04f3e5fc880ad0effa99
humanhash: comet-low-grey-music
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'853'440 bytes
First seen:2024-10-08 17:35:13 UTC
Last seen:2024-10-08 18:45:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:lkq97yr29MYUM6aSKrxXnLIyhqCDPG7JUGM0KrsLX:GqUcJUxazrJn6CDuasLX
Threatray 67 similar samples on MalwareBazaar
TLSH T14B8533567BB3E3D8D23C803BB62C269BBA7621A10CD14679481BB072436DB7B95D4333
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: http://185.215.113.103/luma/random.exe

Intelligence

File Origin
# of uploads :
12
# of downloads :
381
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
X64BB_file.exe
Verdict:
Malicious activity
Analysis date:
2024-10-08 17:40:36 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/ae4bbba5-7ba1-4c79-a7f8-07118de4168d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.9550.24619.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/67056d8406f0c2314b42f2c0/reports/c0f6668f-5810-4749-b5d3-952e2796cc8f/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d45fa187-78d1-45a7-97dc-30186922b25b
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1529256
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-10-08 17:36:13 UTC
File Type:
PE (Exe)
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zn3uxhu6aqt773dhc3aih73hha5jli6svba4xkzadjilu5x3n6sa._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
095ce92c00016b1704e008172d9d052c03b682dec9d677d1f9e82c1c4e75600a
LummaStealer
1bf1af0c96cd1d473dcd319d8173af52b68930f29d1edc9e1c823fd960e547cf
LummaStealer
2d183e51ffc471e6ffd01a38d5c5935c9d723e61ec3d44b7ddf72a52e87a53b2
LummaStealer
49a7efd8296089d8f30b3eb592b13dc8d9f85e7f9091b0e2653f1ceed77482dc
LummaStealer
60618c6adb412741f3ace8a3396d9e7cfc23f90dccbd29e154fb089cb7431200
LummaStealer
7dc3bdaa601f361d05b449921c7f313589a0ec19e0308d5617c962233f9c6a81
LummaStealer
894b2a1e0527fce4d8667b31af4c6f3d2209a0b99e298ed58de7914ad1b8f94d
LummaStealer
d323f2034ee22ad7b02394182f3d52456b3fb3a37bc0d1cea888c5a482c88a26
LummaStealer
error
LummaStealer
f930a52a2107da490787657629a889c86714dd2fa9dbd7a18ac31866811ec6e9
LummaStealer
+ 57 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery evasion stealer
Link:
https://tria.ge/reports/241008-v6j5ks1ane/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/26e2c408-f940-4efc-9973-8398acfa82f1
Unpacked files
SH256 hash:
6191f163b5878707df94bce0a9dbb2a8fbf1810a8ca5adf717998d8de2e3c098
MD5 hash:
c8a085ec496e76dd1c4f9810b6771e1a
SHA1 hash:
75536d48b43299c72445f5def55ddc12309590e4
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/1fea8fb6-fd9e-4792-9590-586e5f960692/
SH256 hash:
cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4
MD5 hash:
2e919c1035fd04f3e5fc880ad0effa99
SHA1 hash:
43b98069916079f706be9822a5f866f91486e10e
Link:
https://www.unpac.me/results/1fea8fb6-fd9e-4792-9590-586e5f960692/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cb774b9e9e04/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe cb774b9e9e0427ffec6716c083ff67383a95a3d2a841cbab201a50ba76fb6fa4

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments