lumma | 7024da9ee94f2a04a85632109893dc2b

Sharing

Copy URL Twitter E-mail

General

Target

7024da9ee94f2a04a85632109893dc2b
Size

5.2MB
MD5

7024da9ee94f2a04a85632109893dc2b
SHA1

b619ec0c76d3f3c00ad56228b925e21031dee929
SHA256

2351b1db2acb437b2e46befb9e344d667f6184944e1eab3ec7c8bf81e0dfc750
SHA512

1adabf455cba9448c7782bcf21ff0411afeb401e5962dd22c4d3027b1743e35097f54d234389b390026a18aec31a26b83a463e509c254107b9ce86214dd35349
SSDEEP

98304:lVmSnVAsZUuydoBvWSg36JR15Crt7BiY327:KAVAsZnymBjs6JheBiT

Score

10^/10

lumma

Malware Config

Signatures

Detect Lumma Stealer payload V4 1 IoCs

resource	yara_rule
sample	family_lumma_v4

Lumma family
lumma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7024da9ee94f2a04a85632109893dc2b

Files

7024da9ee94f2a04a85632109893dc2b
.exe windows:6 windows x86 arch:x86

39c2c84189bc576ff4bb67d26eec6d86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dsound

ord1

kernel32

lstrcmpA
lstrcmpiA
CreateFileA
FindFirstFileA
ReadFile
GetFileSize
GetSystemDirectoryA
ExitProcess
FindClose
FindNextFileA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
CreateDirectoryA
WriteFile
GetLocalTime
OutputDebugStringA
WritePrivateProfileStringA
SetFilePointer
VirtualProtect
GlobalAlloc
GetComputerNameA
SuspendThread
DeleteFileA
ResumeThread
CopyFileA
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
SetThreadPriority
TerminateThread
GetExitCodeThread
_lopen
_lcreat
_lread
_lwrite
_lclose
CompareFileTime
GlobalUnlock
GlobalLock
GlobalHandle
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
IsDBCSLeadByte
LocalAlloc
LocalFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
TerminateProcess
CreateProcessA
GetVersionExA
SetEndOfFile
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
lstrcatA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
GetModuleFileNameW
SetConsoleCtrlHandler
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetModuleFileNameA
FreeLibraryAndExitThread
FreeLibrary
WriteProcessMemory
GetTickCount
OpenThread
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetCurrentProcess
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ExitThread
DuplicateHandle
CloseHandle
IsDebuggerPresent
DeleteCriticalSection
InitializeCriticalSectionEx
CompareStringEx
GetStringTypeW
GetLocaleInfoEx
LCMapStringEx
EncodePointer
FormatMessageA
GetCurrentThread
Module32Next
WriteConsoleW
Module32First
Thread32Next
Thread32First
CreateToolhelp32Snapshot
lstrlenA
lstrcpyA
lstrcpynA
LoadLibraryA
GetProcAddress
FlushFileBuffers
GetModuleHandleA
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap

user32

MessageBoxA
GetKeyState
SendMessageA
OffsetRect
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
RegisterClassA
CreateWindowExA
ClientToScreen
DestroyWindow
ShowWindow
CreateDialogParamA
GetDlgItem
GetClientRect
LoadCursorA
WaitMessage
PostQuitMessage
SetTimer
GetSystemMetrics
LoadMenuA
GetMenu
SetMenu
CreateMenu
CheckMenuItem
EnableMenuItem
SetForegroundWindow
LoadIconA
DestroyIcon
SetWindowPos
AdjustWindowRectEx
CharToOemA
OemToCharA
CharUpperA
PostMessageA
CallWindowProcA
ShowCursor
GetWindowLongA
SetWindowLongA
SetWindowTextA
ReleaseDC
UpdateWindow
GetClassNameA
EnumWindows
CharLowerA
GetDC
UnregisterClassA
GetWindowTextA
FindWindowA
GetWindow
wsprintfA

gdi32

CreateSolidBrush
GetStockObject
SetTextColor
GetObjectA
SelectObject
GetDIBits
DeleteDC
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetTextExtentPointA
DeleteObject
CreateFontA

advapi32

RegCloseKey
RegDeleteValueA
RegOpenKeyA
RegCreateKeyExA

shell32

ShellExecuteA
Shell_NotifyIconA

ole32

CoCreateInstance
CoInitialize
CoUninitialize

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx
D3DXCreateTextureFromFileA
D3DXGetImageInfoFromFileInMemory
D3DXCreateFontA

winmm

mixerClose
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mmioAscend
mmioDescend
mixerGetDevCapsA
mmioSetInfo
mmioGetInfo
mmioSeek
mmioWrite
mmioRead
mmioClose
mmioOpenA
timeEndPeriod
timeBeginPeriod
timeKillEvent
timeSetEvent
mixerOpen
timeGetTime
mmioAdvance
mmioCreateChunk

shlwapi

PathFileExistsA

msvfw32

ICSendMessage
ICDecompress
ICLocate
ICClose

avifil32

AVIStreamOpenFromFileA
AVIStreamInfoA
AVIStreamRelease
AVIFileExit
AVIFileInit
AVIStreamRead
AVIStreamLength
AVIStreamReadFormat

iphlpapi

GetAdaptersInfo

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile
HttpQueryInfoA

wsock32

WSACleanup
accept
bind
connect
inet_ntoa
htons
inet_addr
listen
recv
send
setsockopt
socket
gethostbyname
gethostname
closesocket
WSAStartup
WSAGetLastError
WSAAsyncSelect
__WSAFDIsSet
select
ioctlsocket

imm32

ImmGetDescriptionA
ImmGetProperty
ImmGetContext
ImmReleaseContext
ImmGetCompositionStringA
ImmGetCandidateListCountA
ImmGetCandidateListA
ImmGetConversionStatus
ImmSetConversionStatus
ImmSetOpenStatus

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 435KB - Virtual size: 435KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 93.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39c2c84189bc576ff4bb67d26eec6d86

Headers

DLL Characteristics

File Characteristics

Imports

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

d3d9

d3dx9_43

winmm

shlwapi

msvfw32

avifil32

iphlpapi

wininet

wsock32

imm32

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 435KB - Virtual size: 435KB

.data Size: 1.3MB - Virtual size: 93.0MB

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 256KB - Virtual size: 256KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 435KB - Virtual size: 435KB

.data
Size: 1.3MB - Virtual size: 93.0MB

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 256KB - Virtual size: 256KB