MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a
SHA3-384 hash: f8c13fee780df9ab2d1bf18cc621f7bc337db196b53e6fd21542a3df34c01b4d4f23b48168e602fe3f447316c682a2b0
SHA1 hash: 3fa90ce53a399dbcb765990a18dbd5c71b407cfc
MD5 hash: 5c320953f68110bc451f42495ef0a296
humanhash: green-cardinal-hot-nuts
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:3'495'424 bytes
First seen:2023-11-18 09:28:52 UTC
Last seen:2023-11-18 14:02:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f091eecefc1b49cd7a2a9cf6847cbb0 (1 x LummaStealer, 1 x Rhadamanthys)
ssdeep 49152:OPX0ONuiBg8FsUMQMX/mH/xnJhMrqF3Ie73PpwfeTPYZylg5QrFRbZS2bvLra+Po:quirsUMti/jC2eiMmqQ7bZSoXPo
Threatray 1 similar samples on MalwareBazaar
TLSH T175F59E55B3A801A8E1F7C27CD9A6425AEAB178454F30E7DF12A0465E1F33FE19D39322
TrID 89.2% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.9% (.ICL) Windows Icons Library (generic) (2059/9)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f0b8c8d0b4f6e272 (1 x LummaStealer)
Reporter andretavare5
Tags:exe LummaStealer


Avatar
andretavare5
Sample downloaded from https://cdn.discordapp.com/attachments/1174371145454211074/1175209617601605832/Lwsecure_beta.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
473
Origin country :
US US
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
New Text Document.exe
Verdict:
Malicious activity
Analysis date:
2023-11-18 14:45:33 UTC
Tags:
loader stealer vidar stealc hijackloader redline lumma opendir risepro raccoon recordbreaker amadey botnet formbook xloader miner agenttesla kelihos trojan lokibot systembc proxy autoit spyware privateloader
Link:
https://app.any.run/tasks/5bc35b21-8151-4f2b-bf6a-ba981bac8773

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/459043/
Detection(s):
SecuriteInfo.com.Win64.Malware-gen.27731.7116.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching cmd.exe command interpreter
Creating a file in the %temp% directory
Launching a process
Reading critical registry keys
Query of malicious DNS domain
Stealing user critical data
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
90%
Tags:
control greyware lolbin packed remote shell32 tracker
Link:
https://www.filescan.io/uploads/655883df5b4a525d98f82277/reports/d75d9cb5-b460-4155-a3e9-51cfee41d10b/overview
Verdict:
Suspicious
Labled as:
Win64/TrojanDownloader.Rugmi.T
Link:
https://www.hybrid-analysis.com/sample/e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/eecccae0-100d-43e8-96f3-d29b55fd3934
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1344494
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to behave differently if execute on a Russian/Kazak computer
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
12%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a/
Threat name:
Win64.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2023-11-18 09:29:06 UTC
File Type:
PE+ (Exe)
Extracted files:
137
AV detection:
19 of 38 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4yab4ubkfej64ss7s3acaoqunwcoigcem5ot2ziedz42zjjs6ifa._file
Verdict:
malicious
Similar samples:
e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a
LummaStealer
Result
Malware family:
n/a
Score:
  6/10
Tags:
spyware
Link:
https://tria.ge/reports/231118-lfww1sed6s/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Unpacked files
SH256 hash:
e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a
MD5 hash:
5c320953f68110bc451f42495ef0a296
SHA1 hash:
3fa90ce53a399dbcb765990a18dbd5c71b407cfc
Link:
https://www.unpac.me/results/64ac6b89-8c5d-4905-990c-2ae62ae0158f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/459043/
  
URLhaus
https://urlhaus.abuse.ch/url/2731896/

Comments