MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099
SHA3-384 hash: bbde14516806a083571f045d9052e17b71a2a689fa03dc29d71304ac2156bcf1b56bbe6d7503889d9727fe90113b14d3
SHA1 hash: 054c72639fcba7d3bf94dcbe2f630fe3ad1ce986
MD5 hash: 716dc67ab6a30a38edd5e4ca46df4d87
humanhash: virginia-twenty-fanta-glucose
File name:716dc67ab6a30a38edd5e4ca46df4d87.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:547'840 bytes
First seen:2024-01-18 20:52:36 UTC
Last seen:2024-01-18 22:36:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash eca83d04a8476bcc568e22f1bc0330c0 (2 x UACModuleSmokeLoader, 2 x Stealc, 2 x GCleaner)
ssdeep 6144:knjH5WJwWFLI8H6I1Z1pfakSkDjmgCCFHXbuhs/j9qc5Jisw5pH2GAU6sCCHcfwN:ojZWJwW2OP71xHnDqfC5jQc5YWscYG2
TLSH T19AC4E01121E7D132E3F7EA319974D6704ABB78136A7159CF1AC613791F24AE38A3132B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 3370ccd2ccf033da (36 x Smoke Loader, 10 x Stealc, 8 x GCleaner)
Reporter abuse_ch
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
329
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/471567/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.14026.19291.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65a98fafec34a351d14f2d6d/reports/32e991d3-3e68-43e5-80da-f7e6010be354/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/40f0a9b8-7a6a-45dd-a1f3-77ca59fb79e2
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1377041
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2024-01-18 20:53:05 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6wjb5bvsyzyaxtquv4zap63sfkks3iows7yzw4ec3iulunctmcmq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240118-zn91hahahj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
a6f7d12bc6f14956368b37d6a81ae05961a3fec1fc301a89829cd1ba6c139185
MD5 hash:
869cf756f65dad739d42ae1c9e3f95ca
SHA1 hash:
ab22eb590856e9e1821fd7fea07e7c77d23e5299
Link:
https://www.unpac.me/results/2bdf9e4d-b0ad-4230-b589-47504de468ed/
SH256 hash:
f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099
MD5 hash:
716dc67ab6a30a38edd5e4ca46df4d87
SHA1 hash:
054c72639fcba7d3bf94dcbe2f630fe3ad1ce986
Link:
https://www.unpac.me/results/2bdf9e4d-b0ad-4230-b589-47504de468ed/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/471567/

Comments