MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d24ea00ed73ab0806701d32471a42b615a46c10e2db31df9d78a550d2b992b69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d24ea00ed73ab0806701d32471a42b615a46c10e2db31df9d78a550d2b992b69
SHA3-384 hash:	53088daf210ab3de156a246afe49f226f452a40597b5970579bca41a76dd93efd88d1d5e608ac19d78992f2ab64a520f
SHA1 hash:	5a4554aea615f6bce4a33f6341ef7c432202512c
MD5 hash:	db5bb990c04bc29e0e5ad85f82fc2f9b
humanhash:	violet-autumn-oven-william
File name:	human-check.b-cdn.net.ps1
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	115 bytes
First seen:	2024-08-26 17:11:47 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJLNyAmarBO/tmt55akuVvp0Pr4/TnOqkkvp:snyuk854kuVvp0Pk/rOsvp
TLSH	T133B092909A6CEA0C42BFBA30191C598FB2038272E1A0366AE89010805A0CA1FD31B248
Magika	powershell
Reporter	aachum
Tags:	LummaStealer ps1

iamaachum

https://human-check.b-cdn.net/verify-captcha-v7.html

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

129

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ccb763e7ff3f5a063c0413

Tags:

Encryption Execution Generic Infostealer Stealth Trojan

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

lolbin lolbin masquerade mshta powershell shell32

Link:

https://www.filescan.io/uploads/66ccb7621c7fd2cfb7052113/reports/b2cddf85-4151-4326-9029-fe714a46bbbd/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d24ea00ed73ab0806701d32471a42b615a46c10e2db31df9d78a550d2b992b69

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox LummaC

Result

Threat name:

LummaC

Alert

Create hunting rule

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1499226

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus detection for URL or domain

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Powershell drops PE file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Very long command line found

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/d24ea00ed73ab0806701d32471a42b615a46c10e2db31df9d78a550d2b992b69

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d24ea00ed73ab0806701d32471a42b615a46c10e2db31df9d78a550d2b992b69/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2jhkadwxhkyiazyb2mshdjblmfnenqiofwzr36oxrjkq2k4zfnuq._file

Threatray unknown

Verdict:

unknown

Hatching Triage lumma

Result

Malware family:

lumma

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma discovery execution stealer

Link:

https://tria.ge/reports/240826-vqtn3svhka/

Behaviour

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Blocklisted process makes network request

Downloads MZ/PE file

Lumma Stealer, LummaC

Malware Config

C2 Extraction:

https://onionoowzwqm.shop/api
https://locatedblsoqp.shop/api

Dropper Extraction:

https://poko.b-cdn.net/poko

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d24ea00ed73ab0806701d32471a42b615a46c10e2db31df9d78a550d2b992b69