MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6b9513371e82f6955cb84cb8a94965db8eab35a299c8b1de6a51860518ee89a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 17


Intelligence 17 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6b9513371e82f6955cb84cb8a94965db8eab35a299c8b1de6a51860518ee89a
SHA3-384 hash: 20aad94c58bce5263adec7425fa22da0a1bd00e9c73632bd44845a18b8e811a10084f667a6d3a89c00d08984166a8587
SHA1 hash: 092b94acc7e5fa0e14a89792cc03673d95bc57bc
MD5 hash: 23e8be61071ed5a9d5c9a635c6c7775a
humanhash: twelve-alpha-neptune-music
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:3'034'624 bytes
First seen:2024-10-25 02:28:30 UTC
Last seen:2024-10-25 02:29:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:JmdtBcKUZrRFU6eyQcljkNtwZckugIy7H7Ehk03FSIyZs2fA:Jm7BcKUZrRFU6eyQcljOwZcs7bi3FBB
Threatray 14 similar samples on MalwareBazaar
TLSH T129E53C92B885B5CFD4BA13BCA627CD42AD5D03B5071509C7A86C78BA7FA3CC117B5C28
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: http://185.215.113.16/luma/random.exe

Intelligence

File Origin
# of uploads :
21
# of downloads :
1'440
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-10-25 02:31:37 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/32b06d84-fa80-45a8-8aca-603a378d5c7b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.26027.13241.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=671b02716eb034bac8ba02de
Tags:
Shellcode Exploit Zusy
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Behavior that indicates a threat
DNS request
Connection attempt
Sending a custom TCP request
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed packer_detected
Link:
https://www.filescan.io/uploads/671b026e3bc311a7e582da2d/reports/7e66f647-edd3-44d1-a108-bae5dfc3ff1a/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/e6b9513371e82f6955cb84cb8a94965db8eab35a299c8b1de6a51860518ee89a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7fba828b-df43-48b7-bdcb-53f1588f35e5
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1541729
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e6b9513371e82f6955cb84cb8a94965db8eab35a299c8b1de6a51860518ee89a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6b9513371e82f6955cb84cb8a94965db8eab35a299c8b1de6a51860518ee89a/
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2024-10-25 02:29:06 UTC
File Type:
PE (Exe)
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=424vcm3r5axwsvolqtfyvfewlw4ovm22fgoiwhpguumgaumo5cna._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
1b8f2a27562335d9b5412931dc3b95696761111dad10b7679c5b6c3bb63d4cdc
LummaStealer
303e18730050b2e5c1eb01fc50eaa8fb78b95f09b5d5d83b09afe48cf13230c0
LummaStealer
503311ef8bf68b63368c796571b9ea400d9160c706cb75cb4a29f864adc26cc6
LummaStealer
786a51f204c62a49d834bb2a09882e4b228009f23e537f9503fa02519311c31e
LummaStealer
891eca3b10cb55384a57e974baa81f8db83f99e57282377ebcd85b7017e29937
LummaStealer
8a13c6e39dc4ca5a2368efd2d0a9fdad9f08898836aa6dca215913038819e0d1
LummaStealer
95b1cfb989f22fc872400433acaa047fc01be081433137307523e4d116390598
LummaStealer
c4211bd3c9a371ba53718fe18cfa58bbddcf62b1e80227c1495d8e566a934328
LummaStealer
c43d7ab216bd8589b5ef2e049cc6186dcdfdc5e437203334a5dbf2f1e54d9f78
LummaStealer
error
LummaStealer
+ 4 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery evasion stealer
Link:
https://tria.ge/reports/241025-cykf9stbkd/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Malware Config
C2 Extraction:
https://clearancek.site
https://licendfilteo.site
https://spirittunek.store
https://bathdoomgaz.store
https://studennotediw.store
https://dissapoiznw.store
https://eaglepawnoy.store
https://mobbipenju.store
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5db32ecb-6a53-44c4-9980-459e7fb8af39
Unpacked files
SH256 hash:
b737813b2455175e79e6abb6eeb105ae90e7d0192039045e5b57fc43f7ce173c
MD5 hash:
eb84c2ca3cb1f4bd07e91c644a8c78d2
SHA1 hash:
aef8d27b1ad3c8f35202c6b3370f0ae1bb9e4180
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/09fee1ce-a96b-4db9-9c3c-21f5178291fb/
SH256 hash:
e6b9513371e82f6955cb84cb8a94965db8eab35a299c8b1de6a51860518ee89a
MD5 hash:
23e8be61071ed5a9d5c9a635c6c7775a
SHA1 hash:
092b94acc7e5fa0e14a89792cc03673d95bc57bc
Link:
https://www.unpac.me/results/09fee1ce-a96b-4db9-9c3c-21f5178291fb/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e6b9513371e8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e6b9513371e82f6955cb84cb8a94965db8eab35a299c8b1de6a51860518ee89a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe e6b9513371e82f6955cb84cb8a94965db8eab35a299c8b1de6a51860518ee89a

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3245480/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments