MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd73d3ab9b4f55b441905f32fe8986ef874d1874c642f4a6f5b183f28f2ab5d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd73d3ab9b4f55b441905f32fe8986ef874d1874c642f4a6f5b183f28f2ab5d4
SHA3-384 hash: 003546d55b702946617b264206b3b23b61351aaed6cb3daf7fdda3cd61ef728f9125c203a2ae868a7798bf27073ed8c5
SHA1 hash: d4a77d69e892a11dfc12500fb05d50a8b623d06c
MD5 hash: e602a0856441e96914de6dca9f4b6871
humanhash: seventeen-ohio-kentucky-washington
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'904'640 bytes
First seen:2024-10-11 01:53:05 UTC
Last seen:2024-10-11 02:29:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:Q8zqY7ta6YK/EwPLiOO6LHRlpTlTSZVnENW3m:JzXM6YiEeimLHvLTSZVMW
Threatray 78 similar samples on MalwareBazaar
TLSH T1AC9533634DB3BA3EDD0C47352B2B5C163492460637AF7D6EAD85BB1C1C239788143A2B
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: http://185.215.113.103/luma/random.exe

Intelligence

File Origin
# of uploads :
14
# of downloads :
393
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-10-11 01:56:18 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/ba0da91e-201e-4d96-ac01-93bc912839c8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.19633.25577.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6708853cf936b5621b0c8205
Tags:
Vmdetect
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm packed
Link:
https://www.filescan.io/uploads/6708853bd0ff8ff2fe485923/reports/8d60a878-d74d-44c8-bab8-c2ce28e7bed1/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/fd73d3ab9b4f55b441905f32fe8986ef874d1874c642f4a6f5b183f28f2ab5d4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ca2e431a-cda9-4bb4-a83d-4fca610cd5b6
Result
Threat name:
LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1531342
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fd73d3ab9b4f55b441905f32fe8986ef874d1874c642f4a6f5b183f28f2ab5d4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd73d3ab9b4f55b441905f32fe8986ef874d1874c642f4a6f5b183f28f2ab5d4/
Threat name:
Win32.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2024-10-11 01:54:12 UTC
File Type:
PE (Exe)
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7vz5hk43j5k3iqmql4zp5cmg56du2gduyzbpjjxvwgb7fdzkwxka._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
074ee51d9bc6abc3f6c43925201998cdcb801413fc80cde720e493a0dc0e6dd5
LummaStealer
08643496ffbec35a84e902dbdbfe27b8b1043d66627dec62d3c6a2f0de76111c
LummaStealer
1c3de2ce166dc064b3f4e242959d4ec8ef30dc61122d50d498126daa8aa993f6
LummaStealer
303e18730050b2e5c1eb01fc50eaa8fb78b95f09b5d5d83b09afe48cf13230c0
LummaStealer
503311ef8bf68b63368c796571b9ea400d9160c706cb75cb4a29f864adc26cc6
LummaStealer
64ebff6e8bc8771871fc410bbda0c6ceef6ffde7c01714913e69f074d3d94210
LummaStealer
bb4eaf8f16d269b45bb7e3fbb594ffb1382a73b321ca13466f8dbd65d420c01d
LummaStealer
bca6b10158b6b5c86e2c29c4be5376e3e576dee27e1a121a2f288c35f1af25da
LummaStealer
error
LummaStealer
f61486d206b225c70691b325e2d7cc5982ec57cedcb8eaa02e8875ccb4835b6f
LummaStealer
+ 68 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery evasion stealer
Link:
https://tria.ge/reports/241011-cbjlfsyhpf/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Malware Config
C2 Extraction:
https://clearancek.site
https://licendfilteo.site
https://spirittunek.store
https://bathdoomgaz.store
https://studennotediw.store
https://dissapoiznw.store
https://eaglepawnoy.store
https://mobbipenju.store
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/79b7f175-61d7-416a-8b33-685a51838537
Unpacked files
SH256 hash:
5ea67fd9c94841aa5789e73e65dece5aad982276dcdf870640b4bb238de2f11f
MD5 hash:
dab3334d91c0341b70936fc8c7e29145
SHA1 hash:
42b6ed6abc995e5980364af88cc45bead4ea3885
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/bdb921ce-2e63-48fd-b745-4c5440d30ef7/
SH256 hash:
fd73d3ab9b4f55b441905f32fe8986ef874d1874c642f4a6f5b183f28f2ab5d4
MD5 hash:
e602a0856441e96914de6dca9f4b6871
SHA1 hash:
d4a77d69e892a11dfc12500fb05d50a8b623d06c
Link:
https://www.unpac.me/results/bdb921ce-2e63-48fd-b745-4c5440d30ef7/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fd73d3ab9b4f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd73d3ab9b4f55b441905f32fe8986ef874d1874c642f4a6f5b183f28f2ab5d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe fd73d3ab9b4f55b441905f32fe8986ef874d1874c642f4a6f5b183f28f2ab5d4

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments