🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7dc5341d88e853c24e76773a37c86e7391a06258d3017b4f996d0cd853e874b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 5


Intelligence 5 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7dc5341d88e853c24e76773a37c86e7391a06258d3017b4f996d0cd853e874b
SHA3-384 hash: 526c894b9abc6dac2bfeacd6eccae943469443928520ac9873d487dcff83403e08fdfbdae4a3e5f58dd257b60e8b63b2
SHA1 hash: e7060aea53faa3c1029a13931a5822eb02c37647
MD5 hash: c5cd55228e61af65e4241fbaadd7e77c
humanhash: summer-jersey-california-angel
File name:❖SetUp✼.zip
Download: download sample
Signature LummaStealer
Create hunting rule
File size:3'364'949 bytes
First seen:2024-11-15 11:08:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:bPSt8S+4uUA4uknnSeh9qMWzhJL4ajqsBzLmZE:b1tBknT9tWzhJUCBzK+
TLSH T178F533672D271A0DF913A5723CE6313709AC2D6DA35C19A1E94EA7C451F4310FAFF88A
Magika zip
Reporter x86
Tags:lumma LummaStealer zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
GB GB
File Archive Information

This file archive contains 13 file(s), sorted by their relevance:

File name:Setup.exe
File size:172'792 bytes
SHA256 hash: e611a1ffbe9e08a2660bc290a581aa0b54637524aaf6040a70e54f97136ce5ac
MD5 hash: aef6452711538d9021f929a2a5f633cf
MIME type:application/x-dosexec
Signature LummaStealer
File name:xprt6.dll
File size:249'856 bytes
SHA256 hash: a259229b5b1b3625c3933bb06cf0465c3743e21d99fe69d871063ca7f572433c
MD5 hash: e4bc0fc01666a0f78717c9c11069ca9e
MIME type:application/x-dosexec
Signature LummaStealer
File name:MKernel.dll
File size:224'768 bytes
SHA256 hash: 46410947d60a8b92869aa2cf27b57a94c710047f168ac3bc23879a8461f8686a
MD5 hash: 98a71909605b7d088f82d66abc64d4c2
MIME type:application/x-dosexec
Signature LummaStealer
File name:MDb.dll
File size:210'432 bytes
SHA256 hash: ab47f3a52c1c2a7f1855c48e2d085e87345590b1fb78353c7070c3b6600843fd
MD5 hash: be1262b27ff4a4349b337cc95b7746e7
MIME type:application/x-dosexec
Signature LummaStealer
File name:msvcr71.dll
File size:348'160 bytes
SHA256 hash: 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
MD5 hash: 86f1895ae8c5e8b17d99ece768a70732
MIME type:application/x-dosexec
Signature LummaStealer
File name:MUtils.dll
File size:634'368 bytes
SHA256 hash: 50dfc607913a47dd266e27f6533f3f6b8f9fe995582f7662a944149a26b5054c
MD5 hash: 6da9a492898b66db78f5c9d3fc7ecc64
MIME type:application/x-dosexec
Signature LummaStealer
File name:MCoreLib.dll
File size:109'056 bytes
SHA256 hash: 153c1b5e96e7bc4c9f858c3cc3bc6cd5e09ef68776d95871ca38824c430654c4
MD5 hash: 815b07c37c83b13457d37ca8c6a7a561
MIME type:application/x-dosexec
Signature LummaStealer
File name:MUIUtils.dll
File size:394'752 bytes
SHA256 hash: 51c8715fac6797b7f962a68903f1f994c2af1088ac31972b5e512dab5ab4fd8e
MD5 hash: 97d6efb8b8e0b0f03701a7bafc398545
MIME type:application/x-dosexec
Signature LummaStealer
File name:MUICoreLib.dll
File size:844'288 bytes
SHA256 hash: 80878e4543959b63cbd87e3ebb82f4988cbbdf9da564370aa15410783c5f343f
MD5 hash: 60a5383ba17d8f519cb4356e28873a14
MIME type:application/x-dosexec
Signature LummaStealer
File name:jjbrdq
File size:1'528'210 bytes
SHA256 hash: e9cfa6bca5d196b427d879066b767822b70d690ce6cf1ab78b35d5f37af9616e
MD5 hash: 8bb89e15ba50b0b6f1ec7aad08c2aef4
MIME type:application/octet-stream
Signature LummaStealer
File name:coolcore49.dll
File size:782'336 bytes
SHA256 hash: 12cddd3c62ff777f1738226fe0b4b36c8170e5e1c0c47fb5913f1a780dc5f450
MD5 hash: 4f27d1bacaf09d1919484355b341c868
MIME type:application/x-dosexec
Signature LummaStealer
File name:lqggk
File size:34'199 bytes
SHA256 hash: c761129446b2444d2aa338f39c710119bed9402ca1a70f053ad5737333df0e55
MD5 hash: 080170f2da34f5cc3cfc185d0eb1b72f
MIME type:application/octet-stream
Signature LummaStealer
File name:msvcp71.dll
File size:499'712 bytes
SHA256 hash: df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
MD5 hash: 561fa2abb31dfa8fab762145f81667c2
MIME type:application/x-dosexec
Signature LummaStealer
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.4774.7048.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=670f91eb707bcd8537fbfa8e
Tags:
injection exploit obfusc
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/f7dc5341d88e853c24e76773a37c86e7391a06258d3017b4f996d0cd853e874b/results/dashboard
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f7dc5341d88e853c24e76773a37c86e7391a06258d3017b4f996d0cd853e874b
Score:
1%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/f7dc5341d88e853c24e76773a37c86e7391a06258d3017b4f996d0cd853e874b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f7dc5341d88e853c24e76773a37c86e7391a06258d3017b4f996d0cd853e874b/
Threat name:
Win32.Downloader.Rugmi
Create hunting rule
Status:
Malicious
First seen:
2024-11-15 11:09:12 UTC
File Type:
Binary (Archive)
Extracted files:
38
AV detection:
19 of 38 (50.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=67ofgqoyr2ctyjhhm5z2g7eg444rubrfruybpnhzs3im3bj6q5fq._file
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/241115-nmra8atcqa/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Malware Config
C2 Extraction:
https://drawwyobstacw.sbs
https://condifendteu.sbs
https://ehticsprocw.sbs
https://vennurviot.sbs
https://resinedyw.sbs
https://enlargkiw.sbs
https://allocatinow.sbs
https://mathcucom.sbs
https://insideparti.cfd
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f7dc5341d88e853c24e76773a37c86e7391a06258d3017b4f996d0cd853e874b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Checking for malicious import combination that common ransomware mostly use
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

zip f7dc5341d88e853c24e76773a37c86e7391a06258d3017b4f996d0cd853e874b

(this sample)

Executable exe e611a1ffbe9e08a2660bc290a581aa0b54637524aaf6040a70e54f97136ce5ac

  
Dropping
SHA256 e611a1ffbe9e08a2660bc290a581aa0b54637524aaf6040a70e54f97136ce5ac
  
Delivery method
Distributed via web download

Comments