MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2cc7f5340634bf3211e4edba67265d8ac19e91d6ba79b59c22e45b67d1faa78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2cc7f5340634bf3211e4edba67265d8ac19e91d6ba79b59c22e45b67d1faa78
SHA3-384 hash: 2ea28267b47fcf2846783647ebcd6d2860b734e8065887a9b1eefd693661d6cc6b963edbc733aa6c1f1ca6ecefe02ede
SHA1 hash: f89ef2c0b6851d2fc116e3ce6059d18061413f34
MD5 hash: 8c157c36b43d6fc91aa9a50e8bed1a9a
humanhash: michigan-seventeen-freddie-pip
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:3'164'672 bytes
First seen:2024-11-06 10:13:57 UTC
Last seen:2024-11-06 12:59:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:N204Y7kxmKSrWemTuHV3T+LWoKhMbqA3TSV:k04Y7OmKS/mTuJTUWo8ANS
Threatray 175 similar samples on MalwareBazaar
TLSH T1FAE528A2B505E38BD48F16755067CD8A6A5D03AD4F1F08CBAC7E747A7E63CC016E6C28
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: http://185.215.113.16/luma/random.exe

Intelligence

File Origin
# of uploads :
29
# of downloads :
426
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-11-06 10:16:07 UTC
Tags:
lumma stealer possible-phishing loader stealc
Link:
https://app.any.run/tasks/fc77a109-e696-4be7-a6a4-64daadfdffca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.3526.24637.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=672b440a49e92a05dde36ae3
Tags:
vmdetect spam
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm packed packed packer_detected
Link:
https://www.filescan.io/uploads/672b416f1f9f8b4ddbfe4d48/reports/78191342-881c-4e0d-bbcd-2b5deb26b2bb/overview
Verdict:
Malicious
Labled as:
Jaik.Generic
Link:
https://www.hybrid-analysis.com/sample/f2cc7f5340634bf3211e4edba67265d8ac19e91d6ba79b59c22e45b67d1faa78
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/017f0a58-959b-42d6-8d47-d6636246fa05
Result
Threat name:
LummaC, Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1550026
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for sample
Maps a DLL or memory area into another process
Monitors registry run keys for changes
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1550026 Sample: file.exe Startdate: 06/11/2024 Architecture: WINDOWS Score: 100 43 thumbystriw.store 2->43 45 presticitpo.store 2->45 47 4 other IPs or domains 2->47 71 Suricata IDS alerts for network traffic 2->71 73 Found malware configuration 2->73 75 Antivirus detection for URL or domain 2->75 77 11 other signatures 2->77 8 file.exe 17 2->8         started        13 msedge.exe 68 629 2->13         started        signatures3 process4 dnsIp5 65 185.215.113.206, 49771, 49878, 80 WHOLESALECONNECTIONSNL Portugal 8->65 67 185.215.113.16, 49723, 80 WHOLESALECONNECTIONSNL Portugal 8->67 69 2 other IPs or domains 8->69 41 C:\ProgramData\chrome.dll, PE32 8->41 dropped 79 Detected unpacking (changes PE section rights) 8->79 81 Attempt to bypass Chrome Application-Bound Encryption 8->81 83 Query firmware table information (likely to detect VMs) 8->83 87 9 other signatures 8->87 15 msedge.exe 2 10 8->15         started        18 chrome.exe 8->18         started        21 WerFault.exe 8->21         started        85 Maps a DLL or memory area into another process 13->85 24 msedge.exe 57 13->24         started        26 msedge.exe 13->26         started        28 msedge.exe 13->28         started        30 3 other processes 13->30 file6 signatures7 process8 dnsIp9 89 Monitors registry run keys for changes 15->89 32 msedge.exe 15->32         started        49 192.168.2.6, 443, 49698, 49699 unknown unknown 18->49 51 239.255.255.250 unknown Reserved 18->51 34 chrome.exe 18->34         started        37 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->37 dropped 53 13.107.246.57, 443, 58626, 58628 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 24->53 55 20.125.209.212, 443, 58662, 58695 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 24->55 57 25 other IPs or domains 24->57 39 C:\Users\user\AppData\Local\...\Cookies, SQLite 24->39 dropped file10 signatures11 process12 dnsIp13 59 www.google.com 172.217.18.100, 443, 49822, 49823 GOOGLEUS United States 34->59 61 play.google.com 216.58.206.78, 443, 49864, 49884 GOOGLEUS United States 34->61 63 2 other IPs or domains 34->63
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f2cc7f5340634bf3211e4edba67265d8ac19e91d6ba79b59c22e45b67d1faa78
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2cc7f5340634bf3211e4edba67265d8ac19e91d6ba79b59c22e45b67d1faa78/
Threat name:
Win32.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2024-11-06 10:14:12 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lgh6u2amnf7gii6j3n2m4tf3cwbt2i5notzwwocfzc3m7i7vj4a._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
05e4786fd4addc5e2660389c6f46aa5485bdfeec228b17fae8c02c324341a4e8
LummaStealer
0d1af38dfe71f73f6f27771ebd8fba5298732792b12c447e756cc657e3242bf7
LummaStealer
1a62d7d8e19970df7d386e5c72306d49ca8c8455aed153a1701db3574e8fa256
LummaStealer
26309ceffdfb8ef91a3d435a569841ed8532f855557aeee54620a54e2c2dceca
LummaStealer
57a15eecd54ed9592c6d49f6b5a562ed44c049f1265ecf7b42a90569dc8f8740
LummaStealer
6e2b1ee5f03b5cc5117b10f8436ae0b716c0e2c7f3accf3d97928a322bf71e9e
LummaStealer
6ecffa523dd0f47994bde41a4b27a1074a5b99b3028bd6b7fdc7a773b5fd610d
LummaStealer
7a8091adae649be1b60dffc3835d7ca8b068f78925aa22e4fbb610ac261da3c2
LummaStealer
d0d045456df35ffcfb8a8480d5b5cb3f2d9d75a97152e961322f1465eb826a1a
LummaStealer
error
LummaStealer
+ 165 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery evasion stealer
Link:
https://tria.ge/reports/241106-l9mv7sybnc/
Behaviour
Suspicious behavior: EnumeratesProcesses
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://founpiuer.store/api
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/cd33e952-eaee-4bfe-a0e4-a5fb6ac89bf1
Unpacked files
SH256 hash:
527a07b6f99a3570fedbd483e84bdd5573dd309454a5892a6792651d33f90c82
MD5 hash:
6bbc1f07562b19bb71aaf1fe9ec4c10d
SHA1 hash:
2b4484a0d8e854b8d7af1d658c87fc0a7cc23a2e
Link:
https://www.unpac.me/results/f4f09326-00fa-42b0-9ae6-fd6a2a600ef8/
SH256 hash:
f2cc7f5340634bf3211e4edba67265d8ac19e91d6ba79b59c22e45b67d1faa78
MD5 hash:
8c157c36b43d6fc91aa9a50e8bed1a9a
SHA1 hash:
f89ef2c0b6851d2fc116e3ce6059d18061413f34
Link:
https://www.unpac.me/results/f4f09326-00fa-42b0-9ae6-fd6a2a600ef8/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f2cc7f534063/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe f2cc7f5340634bf3211e4edba67265d8ac19e91d6ba79b59c22e45b67d1faa78

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3245480/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments