MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364
SHA3-384 hash: 58bf0a4f59aa0456993e8adce23466a4993ffc4a045d21e3c9d977c38d370e10e0ca76e7093437dec3cfd88cd6424b06
SHA1 hash: 49973561093a12c7ff5e95e70d979449db8ccdfa
MD5 hash: 529b5928d366cd9c58ef301023192590
humanhash: uniform-victor-orange-arizona
File name:Set-up.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:4'294'144 bytes
First seen:2025-02-01 17:04:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7dff8bff05959b29c4fc50356e19b532 (2 x LummaStealer)
ssdeep 98304:7jdqPsOawQXnEkD8yGuMFyJIw20pTjFq+r34/x:3d0sOIEa4u2ML20Nj4+LAx
TLSH T1F616BE22BB51D46AE0674A38D80FA2EC7511BD646F34849736A02FCDB7B67C5B939303
TrID 56.5% (.EXE) InstallShield setup (43053/19/16)
13.8% (.EXE) Win64 Executable (generic) (10522/11/4)
13.1% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
5.9% (.EXE) Win32 Executable (generic) (4504/4/1)
2.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
File icon (PE):PE icon
dhash icon 0513ec3972765c0d (7 x LummaStealer, 1 x Meterpreter, 1 x Amadey)
Reporter abuse_ch
Tags:de-pumped exe LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
491
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Set-up.exe
Verdict:
Malicious activity
Analysis date:
2025-02-01 17:07:56 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/439624c8-1456-4705-a681-153c4c3f732e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.32190.30338.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=679e545b416a81ccc3c4e58e
Tags:
shellcode phishing virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
DNS request
Connection attempt
Sending a custom TCP request
Connection attempt to an infection source
Behavior that indicates a threat
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint keylogger packed packed packer_detected
Link:
https://www.filescan.io/uploads/679e545d3ee61cd16d2fd6d2/reports/a00be4f6-0a05-4f6f-8fe9-fc0d0748662f/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/da79edf5-bad1-42cc-8c66-0035ec0a8ca4
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1604581
Signature
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM3
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
43%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=326ii5rqxszeszbko4ohyfkz7bd2xvbwxwj3qpjm4k5udjk6unsa._file
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/250201-vl25na1qfv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://toppyneedus.biz/api
Verdict:
Suspicious
Tags:
lumma_stealer c2 lumma stealer
YARA:
n/a
Link:
https://app.threat.zone/submission/f3de3f3d-7c65-4664-b815-230fac3bc1ee
Unpacked files
SH256 hash:
debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364
MD5 hash:
529b5928d366cd9c58ef301023192590
SHA1 hash:
49973561093a12c7ff5e95e70d979449db8ccdfa
Link:
https://www.unpac.me/results/05dfb337-b3c0-4579-b3d7-ecc54ea38979/
SH256 hash:
678359c47ac8bbbd30d02b4a3663a7b644d24b40255dd1029cc1b1fc0d454fd6
MD5 hash:
d3b55e81d22181faac45025fa324fbb6
SHA1 hash:
46dd39a49d024acc0a659b8e26014fa29dcc7e5e
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/05dfb337-b3c0-4579-b3d7-ecc54ea38979/
Parent samples :
822b737a9db5ead10aec86a34feb57141e43c5679b620ce3191d335997a3f44d
59ae8d923ec039ce1f269ac6bd85486842f399d9e027bf113c53628410bad6bc
810cb4d332ade84e4bb0a4d952180ccb4e5428e19445f9f5d71cd57a7030cf2b
debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364
5d5e2231b8a8febafd04afef45760857c1a601b91dfb0c7c81881c9eadcf0e8a
9fe86d6c49079c5c47955ea7b2c04a1b9e16340b88799fc02bceaee4e4f3e99e
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/05dfb337-b3c0-4579-b3d7-ecc54ea38979/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/05dfb337-b3c0-4579-b3d7-ecc54ea38979/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Lumma
Create hunting rule
Author:kevoreilly
Description:Lumma Payload
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MoleBoxv20
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Lumma_4ad749b0
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

zip fe860f7ab7763f9b394551f6e2a610050e246fb07ed0f46dd199263209e382fa

LummaStealer

Executable exe debc847630bcb249642a771c7c1559f847abd436bd93b83d2ce2bb41a55ea364

(this sample)

  
Dropped by
MD5 75c6d209f0a2a18bb5bb2748cbe3f1a3
  
Dropped by
SHA256 fe860f7ab7763f9b394551f6e2a610050e246fb07ed0f46dd199263209e382fa

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
shell32.dll::SHFileOperationA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
wininet.dll::InternetCloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetDriveTypeA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::MoveFileA
kernel32.dll::GetFileAttributesA
kernel32.dll::FindFirstFileA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::EmptyClipboard
user32.dll::FindWindowExA
user32.dll::FindWindowA
user32.dll::OpenClipboard

Comments