MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce17af59a2414b2dd199529a1c0e47d9bdd9b7f01c793b0e7dacaf27b12abca3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ce17af59a2414b2dd199529a1c0e47d9bdd9b7f01c793b0e7dacaf27b12abca3
SHA3-384 hash:	690091e64005ee9755da4e289ed0e54df2ff53a8e24f971da16dcf8c9e9a2ef3949904d5f5b24df3befded572a6a3ef9
SHA1 hash:	17ca374e94ddc5b00bc1695d2d7814d76b195ceb
MD5 hash:	0656c52b45da83ec59b528a4ec3745d8
humanhash:	oxygen-aspen-kitten-texas
File name:	papel-162254_736.exe
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	101'698'520 bytes
First seen:	2023-09-18 18:13:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (527 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:n4hh+lnPqH7jMz+j+nOAvYFQ157bOQUZAOKszEocr9RVhJoWPu4eXwoJ4RTBVqpJ:nSkPqUzzn9ppnU2OKwEL5jhOgoJ4FHqn
Threatray	46 similar samples on MalwareBazaar
TLSH	T1F828338CF766C9D3EC1A01B9353719F11F629E0A20E9AD5A2789731748B874390A77CF
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
dhash icon	f4f4d8d4f474d4cc (1 x LummaStealer)
Reporter	Berto
Tags:	exe LummaStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

331

Origin country :

BR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

papel-162254_736.exe

Verdict:

Malicious activity

Analysis date:

2023-09-18 18:16:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8d309c96-b033-4f45-9658-93eaa41bc02a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Searching for the Windows task manager window

Sending a custom TCP request

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Creating a file

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/6508937033582f234efb1718/reports/f4f83330-0d1f-406e-8fbb-68d931b00125/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ce17af59a2414b2dd199529a1c0e47d9bdd9b7f01c793b0e7dacaf27b12abca3

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

rans.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1310261

Signature

Drops large PE files

Modifies the context of a thread in another process (thread injection)

Sets debug register (to hijack the execution of another thread)

Uses shutdown.exe to shutdown or reboot the system

Writes or reads registry keys via WMI

Writes registry values via WMI

Yara detected Costura Assembly Loader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zyl26wnciffs3umzkknbydsh3g65tn7qdr4twdt5vsxspmjkxsrq._file

Threatray malicious

Verdict:

malicious

Similar samples:

2b802605ece335f6ff05062be544b40fc7e939c69391fbbaa4e930f5d621d064

LummaStealer

30a1ae69eb70083e1fe40c28becf7de5ec557705aae764af211f70f87ae5a403

LummaStealer

398cb27e45b7edad5322cbf38a9c39510bb9d8b3267b6d88d9cb1c53c575a6bb

LummaStealer

41d9459adfc2174e254616e62e78811abee49d1114f044df8ef04eab28ed0514

LummaStealer

47d9aeb26536b9d9c74b69c0e7510cbdb6c3858e953711db573a5ff9112214cb

LummaStealer

516b7bd1f6bf44033b1c80a7ca6044ad76ade2449d2c429940ff311fb661d5d4

LummaStealer

5b7b0c5236d7365c0c65ce32845469f0da901f775319b93a47df593925f54205

LummaStealer

866ad0e1f44d12677e3cd565d47283d6229df46e23387c1ed482abe145ce080d

LummaStealer

+ 36 additional samples on MalwareBazaar

Hatching Triage lumma

Result

Malware family:

lumma

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/230918-wvcf2abf4x/

Behaviour

Enumerates processes with tasklist

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Detect Lumma Stealer payload V2

Lumma Stealer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.