MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 5 File information Comments 1

SHA256 hash:	cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8
SHA3-384 hash:	c6472f531c4e6b6ac7f1a54d01e06a6a82ffb3beae62238d8676a83843958d4963aa3ec5a777102856b5107063299415
SHA1 hash:	69468f5d29dd37cfb7fa050efb6ed66549e4b078
MD5 hash:	eab7f08575df2bde86f93ff0cb02f927
humanhash:	kitten-green-blossom-lemon
File name:	eab7f08575df2bde86f93ff0cb02f927
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	491'048 bytes
First seen:	2024-10-19 14:29:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	12fb41fe7c2715179030b9cdaa5263a9 (10 x LummaStealer, 1 x Vidar)
ssdeep	12288:TzyuKRyyls6TJMlP9D0EKNOCJIwuf33MEO:Sury66mp5WYct
TLSH	T1C1A4024276C08072D57119720970EBB22BBCFD740D605EBB33D99ABA4F643C19A26D27
TrID	32.2% (.EXE) Win64 Executable (generic) (10522/11/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	zbetcheckin
Tags:	32 exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

429

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

eab7f08575df2bde86f93ff0cb02f927.exe

Verdict:

Malicious activity

Analysis date:

2024-10-19 14:34:04 UTC

Tags:

lumma stealer exfiltration

Link:

https://app.any.run/tasks/5615cf41-47bf-4f95-9c0b-458236428491

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PWS.Lumma.707.6509.17164.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6713c26de706a56b5a0314bd

Tags:

Injection Exploit Obfusc

Result

Verdict:

Clean

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

exploit microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/6713c26bb21b1aa5a918ca4a/reports/20438033-ed92-4ed7-b782-9c3f0cd29b3e/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

LummaC2 Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c19f3700-9861-48b5-ae92-13aa4f10ddb0

Result

Threat name:

LummaC

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1537790

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-10-19 14:30:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zwrwb6yglfxlp33yxm2jmh6eappqjjhswhh6iaevv3qd7sqj5c4a._file

Verdict:

malicious

Label(s):

lummastealer

Similar samples:

error

LummaStealer

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/241019-rt5nza1bqc/

Behaviour

Modifies system certificate store

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Malware Config

C2 Extraction:

https://conceptionnyi.sbs
https://platformcati.sbs
https://nervepianoyo.sbs
https://qualifielgalt.sbs
https://smashygally.sbs
https://fightyglobo.sbs
https://modellydivi.sbs
https://pioneeruyj.sbs

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/24ed50f1-dc59-451f-8498-50f66aede461

Unpacked files

SH256 hash:

6e3a3bbf6478c8e6c63d22f887a00fc8655e10212e16bf87fdcbc7306f7ea569

MD5 hash:

19f6446cf95c440e28c519ccfa46e07a

SHA1 hash:

b6d6ed35f3a7df542d788456a6478550da339fac

Detections:

LummaStealer

Link:

https://www.unpac.me/results/9c8fc749-e072-458a-ba39-7fa96724964e/

Parent samples :

cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8
885c6941d87ec16785da0ebbffd5334c06a5a1344b67f603937917b9ace9504d
a6044a9142ce3fed5f4db0944083df8a1d51ba5d974eda948310c6116addd0d7
bffe5190d5f063e1d2650a4282d4ea0fd3f02e824773c7dc767ef915089db457
b1621c26902c7492590479c9739e9271ea8ff066bc2c2eed9ce1f8599da328d1
8456cc2d2a31cb075f95053c8eb886a47ba8381a2ba2fbe0866120fb24ff41bd
5bd0a7c399000541ab5f7398af02d5ced96e4f3adcea59a63c35dcf890bdc8de
f63fec027d91bf28bf3e219ee984a500c6943f3e0455a27bad178ed93fadeb1c
a7756930981261f94e828a6e4edd39c82dc2959cd0c03a8e65efd73cb8939cd2
ba833b2b6210b781718e625b632e46751ab28582a5f1e475c44a425b3409ee2a
21424c9386ed6c518f89ffd488b7d32e64c34d1c9162c5935db4bf29efb72e32
1514eb1f1c1dd062e340c3cd3dac8103b23622b910ef932716a8d1f8f8debb4d

SH256 hash:

cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8

MD5 hash:

eab7f08575df2bde86f93ff0cb02f927

SHA1 hash:

69468f5d29dd37cfb7fa050efb6ed66549e4b078

Link:

https://www.unpac.me/results/9c8fc749-e072-458a-ba39-7fa96724964e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe cda360fb06596eb7ef78bb34961fc403df04a4f2b1cfe40095aee03fca09e8b8

(this sample)

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-10-19 14:29:08 UTC

url : hxxp://assets.padmamuseum.gov.bd/css/63e909b3647d.exe