MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddb4e7bd2fe1117d13547d715edc5578f01741d16c4bcd8a2ecb6d5836f4b94a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	ddb4e7bd2fe1117d13547d715edc5578f01741d16c4bcd8a2ecb6d5836f4b94a
SHA3-384 hash:	b6f6a54497aeace70de6fe7d03d34606ffd62306e02fa8415bea7086bb50f739d6966c1cf491722a539d98d92f19f94f
SHA1 hash:	1f04df524703f5a034993e9dd5bd07b6a0899f8a
MD5 hash:	76ed908e14fced8512c3979445f83d82
humanhash:	monkey-two-blossom-triple
File name:	a
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'017'996 bytes
First seen:	2024-01-29 09:43:35 UTC
Last seen:	Never
File type:	unknown
MIME type:	text/plain
ssdeep	12288:jrMfTmC0fo+/VNihkHs+JuxlS+A/qwA29O896N+A:P0mHomiWHsv3K/qwWk6NV
TLSH	T14525AFCB702D54D58C00AAC6AE7889C3EB25057BC6754880367BAA496E374FCC72FE75
Reporter	angel11VR
Tags:	java javascript lumma LummaStealer

angel11VR

#Lumma #Stealer #AutoIt #RAR #PWD #EXE
email attach .zip1 > (.rar1) PWD or (.rar1+rar2+rar3) PWD > .exe > C2
IOC`s
https://pastebin.com/iJVw4wC8

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

Vendor Threat Intelligence

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/65b77366096abd9a02733bc0/reports/daff3125-e652-491e-b2c5-4a10f321344e/overview

Verdict:

Suspicious

Labled as:

Trojan/BAT.Injector

Link:

https://www.hybrid-analysis.com/sample/ddb4e7bd2fe1117d13547d715edc5578f01741d16c4bcd8a2ecb6d5836f4b94a

Result

Verdict:

MALICIOUS

Score:

18%

Verdict:

Benign

File Type:

ASCII

Link:

https://malprob.io/report/ddb4e7bd2fe1117d13547d715edc5578f01741d16c4bcd8a2ecb6d5836f4b94a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ddb4e7bd2fe1117d13547d715edc5578f01741d16c4bcd8a2ecb6d5836f4b94a/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3w2oppjp4eix2e2upvyv5xcvpdyboqornrf43croznwvqnxuxffa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ddb4e7bd2fe1117d13547d715edc5578f01741d16c4bcd8a2ecb6d5836f4b94a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.