MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d42fdb11f10e2455d0197dc973cf384fc2f480e596055dcb1994086c8db4a6da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
LummaStealer
Vendor detections: 13
| SHA256 hash: | d42fdb11f10e2455d0197dc973cf384fc2f480e596055dcb1994086c8db4a6da |
|---|---|
| SHA3-384 hash: | 1604a1b5b18f3825d9bc66947b82d5167f06978a46524586fb65a778a716a27d1e388f8bd5be702760f3a0fd5668a6eb |
| SHA1 hash: | d44a23a937e54e099539997de3e48c6461950396 |
| MD5 hash: | b5740976a2285bcd92c4625eec726684 |
| humanhash: | salami-queen-green-paris |
| File name: | b5740976a2285bcd92c4625eec726684 |
| Download: | download sample |
| Signature | LummaStealer |
| File size: | 2'114'304 bytes |
| First seen: | 2023-08-25 00:40:17 UTC |
| Last seen: | 2023-08-25 17:09:58 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger) |
| ssdeep | 24576:SnB5rKkCq/0VvD9wNbda6QEdJgdPras82Nd:SnB5rKkCMusa6QEdm4s827 |
| Threatray | 167 similar samples on MalwareBazaar |
| TLSH | T1A3A5E83036EA510CD9B567301C3AE6C526BBBE7A7F18C61D2169160C9EB3513CB21FB6 |
| TrID | 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.1% (.SCR) Windows screen saver (13097/50/3) 8.9% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | e834e4e4f0e488e8 (1 x LummaStealer) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe LummaStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
354
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b5740976a2285bcd92c4625eec726684
Verdict:
Malicious activity
Analysis date:
2023-08-25 00:42:52 UTC
Tags:
lumma stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LummaStealer
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a custom TCP request
Launching a process
Creating a file
DNS request
Sending an HTTP GET request
Sending an HTTP POST request
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
obfuscated overlay packed packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
LummaC Stealer
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.Lummastealer
Status:
Malicious
First seen:
2023-08-23 19:09:37 UTC
AV detection:
19 of 36 (52.78%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 157 additional samples on MalwareBazaar
Result
Malware family:
lumma
Score:
10/10
Tags:
family:lumma spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Uses the VBS compiler for execution
Lumma Stealer
Unpacked files
SH256 hash:
56b05c0ff29ab94481c63525c45d5a83d14f5355b6c0b95b8c767893abf5e70c
MD5 hash:
ae511a1f90edd35df63facb2aa1ed114
SHA1 hash:
22ec1a6e1ba4a1439abd2a6cfe71e7299e9f744e
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
SH256 hash:
9e87484d77eff6a2e8b85b64d759e07a166f7994a9069e04d7a2aed93a0b5186
MD5 hash:
10c3c6cb9146a47b47b3ac9274fdac41
SHA1 hash:
1dc9467ac3e07012a147b33717a53b190859e570
SH256 hash:
d42fdb11f10e2455d0197dc973cf384fc2f480e596055dcb1994086c8db4a6da
MD5 hash:
b5740976a2285bcd92c4625eec726684
SHA1 hash:
d44a23a937e54e099539997de3e48c6461950396
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | pe_imphash |
|---|
| Rule name: | PE_Potentially_Signed_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://193.233.255.9/lend/installs.exe