MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2e733137df2e1a7d726335f8ae4d1b4ce83ef2d1d3db2651c23db1a24c918f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2e733137df2e1a7d726335f8ae4d1b4ce83ef2d1d3db2651c23db1a24c918f0
SHA3-384 hash: 8d6cf81955cc9b86c005ac4d7f1aeb5c269cca84cf881800e3006bfc82211a68ad1fac3d64f7201ec68d5d0ec7986c0e
SHA1 hash: c7ade612e6053c7652698d431f59c7ed43a57f19
MD5 hash: e46fcde17771922059b7a826ec4e4ca3
humanhash: vermont-music-leopard-xray
File name:KMSPico.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:287'744 bytes
First seen:2024-02-29 00:46:03 UTC
Last seen:2024-03-08 12:53:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3e9a9cf66c4a31d33ef1279b5d62e5f6 (1 x LummaStealer, 1 x CoinMiner)
ssdeep 6144:1Y3DCZutB4lBjV9d1aZJzuQSoXCbreMbi5N7R397:1Y2Zuf4lf3kJzu9oX8LiP7
Threatray 10 similar samples on MalwareBazaar
TLSH T12E54F02633D0C839D4A621319862DBB54A7BFCA12D35858B77A03B3F9E212C19A3575A
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon d8dcb0aa86c070b8 (1 x LummaStealer)
Reporter 1ZRR4H
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
579
Origin country :
CL CL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/478217/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.13963.16739.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint packed
Link:
https://www.filescan.io/uploads/65dfd407f73edfc477ff6fed/reports/82202eaa-d21a-4483-a0ae-1d4eceba04e0/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/e2e733137df2e1a7d726335f8ae4d1b4ce83ef2d1d3db2651c23db1a24c918f0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/df7f41c0-c8d8-4045-bed9-c9fcf28e35d6
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1400640
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
LummaC encrypted strings found
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e2e733137df2e1a7d726335f8ae4d1b4ce83ef2d1d3db2651c23db1a24c918f0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e2e733137df2e1a7d726335f8ae4d1b4ce83ef2d1d3db2651c23db1a24c918f0/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2024-02-29 00:47:05 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4lttge356lq2pvzggnpyvzgrwthih3zndu63ezi4epnrujgjddya._file
Verdict:
malicious
Similar samples:
04eb716f3da2e504a2a42de697b19bcc66b673fcfbeab0ef0b44d61567409c1c
LummaStealer
4010a68d26a450fc9ad24a82d72c10483690f67b3d9a592a156c0a6942f1169d
LummaStealer
4e516af048f556de1ceaed29a0695586b0c7ecc310e509ac9a839f6b15b174a8
LummaStealer
7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e
LummaStealer
90cc438e254ee84a0362aaab2d05ca61022c2a9d855651831ea9331bdf4a54f7
LummaStealer
9479886827900d0980e785cf43018d78e3f71ccfd1a5f85ed3e74c8354708479
LummaStealer
e2e733137df2e1a7d726335f8ae4d1b4ce83ef2d1d3db2651c23db1a24c918f0
LummaStealer
ef798468db36b921f6c2830f5eb95c6e31b5e118f10a0aea9e944960cdf96a16
LummaStealer
f9e3c1a6284370cd7b6f8cb5a54d4d5f639a6fe0eb6c9a293d350e6505a3df75
LummaStealer
fb649af245b195baa02a4790f237b4c7dad4d9a116ab10ec5fdb9be45dbd628a
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma stealer
Link:
https://tria.ge/reports/240229-a47gwahe88/
Behaviour
Program crash
Lumma Stealer
Malware Config
C2 Extraction:
https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api
Unpacked files
SH256 hash:
b76f9e3dfe6e11fb8f377c79b636185218960e0d09c0ecdd0e916fa9118cec91
MD5 hash:
56e4ed8ad98f1019f853651166229de0
SHA1 hash:
cc84d2ee1e3e1ed5fc7575a14d215f738f6ca9cd
Link:
https://www.unpac.me/results/9bc3961f-4073-4032-8786-810298e422a5/
SH256 hash:
e2e733137df2e1a7d726335f8ae4d1b4ce83ef2d1d3db2651c23db1a24c918f0
MD5 hash:
e46fcde17771922059b7a826ec4e4ca3
SHA1 hash:
c7ade612e6053c7652698d431f59c7ed43a57f19
Link:
https://www.unpac.me/results/9bc3961f-4073-4032-8786-810298e422a5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e2e733137df2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e2e733137df2e1a7d726335f8ae4d1b4ce83ef2d1d3db2651c23db1a24c918f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/478217/

Comments