lumma | 81b16b8e152322da3b81e7703e430c77d3f06e53b0ba24a5a82e0c3e371c9a21[.]bin

General

Target
81b16b8e152322da3b81e7703e430c77d3f06e53b0ba24a5a82e0c3e371c9a21.bin
Size 181KB
Sample230430-1kh82scf82
SHA256 81b16b8e152322da3b81e7703e430c77d3f06e53b0ba24a5a82e0c3e371c9a21
MD5 16685b20847f33924fb8d849229c41f0
SHA1 c37f16cecc342c1f9361a759c1f232f069a8fba6
SHA512 ee00442f939e617893c57cefba4b2e82fabef7d75d6e980daeb4528a40e639404375e4e1b21e2a0136e627a1f13d0a314ed7fdce9e29e20ba4a415bf3b0bb6bb
SSDEEP 3072:5BnBuDhmb9H7V1oVt3J1HsgujusEAqFlxM7bYyaAWxLYWG21N41AnLPW2A5kVXDO:fADwHqdskF28AWhYWX1NoAn51o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Signatures

Detect Lumma Stealer payload V2 1 IoCs

resource	yara_rule
sample	family_lumma_V2

Lumma family
lumma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81b16b8e152322da3b81e7703e430c77d3f06e53b0ba24a5a82e0c3e371c9a21.bin

File Explorer

81b16b8e152322da3b81e7703e430c77d3f06e53b0ba24a5a82e0c3e371c9a21.bin

.exe 181KB

81b16b8e152322da3b81e7703e430c77d3f06e53b0ba24a5a82e0c3e371c9a21.bin

IMPHASH a15f46648d9363aa7d2886234670aa70
SHA256 81b16b8e152322da3b81e7703e430c77d3f06e53b0ba24a5a82e0c3e371c9a21
MD5 16685b20847f33924fb8d849229c41f0
SHA1 c37f16cecc342c1f9361a759c1f232f069a8fba6
SHA512 ee00442f939e617893c57cefba4b2e82fabef7d75d6e980daeb4528a40e639404375e4e1b21e2a0136e627a1f13d0a314ed7fdce9e29e20ba4a415bf3b0bb6bb
SSDEEP 3072:5BnBuDhmb9H7V1oVt3J1HsgujusEAqFlxM7bYyaAWxLYWG21N41AnLPW2A5kVXDO:fADwHqdskF28AWhYWX1NoAn51o
MD5 SHA1 SHA512 SSDEEP

windows x86

Detect Lumma Stealer payload V2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37399

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpiW WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA CloseHandle CreateFileW GetCurrentProcess GetProcessHeap HeapAlloc WideCharToMultiByte HeapFree MultiByteToWideChar lstrcmpW lstrlenW GetStringTypeW lstrcatW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException SetEndOfFile GetFileType GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW SetFilePointerEx GetConsoleMode SetStdHandle GetConsoleOutputCP CompareStringW LCMapStringW GetTimeZoneInformation FlushFileBuffers HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo DecodePointer

user32

GetSystemMetrics EnumDisplayDevicesA ReleaseDC wsprintfW GetDC

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCW GetDIBits DeleteDC GetObjectW DeleteObject

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey

Sharing