lumma | 8beb772305da2dd283336345f4583f97_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
8beb772305da2dd283336345f4583f97_JaffaCakes118
Size 2.1MB
Sample240601-1s3mnagg46
SHA256 8089d4496834e041c475cfbea834211ab5fe67359b2fda8ec4dd107f4606582a
MD5 8beb772305da2dd283336345f4583f97
SHA1 7788d1873dfbcf1ddf92302e800f59fc910fe241
SHA512 7c8cda22781cc0ce1277ff9cf19df91f36ee531a80d8206d2d52544eeaab4f10cd799ada5e9c60c219ca03f7390d257ac43fe1a021b71af35be767ef36224954
SSDEEP 49152:3L25yU+BYsp8fRSooPpdNjHJc81j3q2dZ7z/khSho7PEnhNmvS:3L2MU+ugSRLapzH71jXdZ3/QShnDES
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma

Malware Config

Signatures

Detect Lumma Stealer payload V4 1 IoCs

resource	yara_rule
static1/unpack001/Game.exe	family_lumma_v4

Lumma family
lumma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Game.exe

File Explorer

8beb772305da2dd283336345f4583f97_JaffaCakes118

.zip 2.1MB
Game.exe

.exe 6.1MB

8beb772305da2dd283336345f4583f97_JaffaCakes118

SHA256 8089d4496834e041c475cfbea834211ab5fe67359b2fda8ec4dd107f4606582a
MD5 8beb772305da2dd283336345f4583f97
SHA1 7788d1873dfbcf1ddf92302e800f59fc910fe241
SHA512 7c8cda22781cc0ce1277ff9cf19df91f36ee531a80d8206d2d52544eeaab4f10cd799ada5e9c60c219ca03f7390d257ac43fe1a021b71af35be767ef36224954
SSDEEP 49152:3L25yU+BYsp8fRSooPpdNjHJc81j3q2dZ7z/khSho7PEnhNmvS:3L2MU+ugSRLapzH71jXdZ3/QShnDES
MD5 SHA1 SHA512 SSDEEP

Game.exe

IMPHASH a6957d051e11846d25d8b562cfb8eb2c
SHA256 54b96b39c54868b22418d382b8e8e4f15a5564d5d3aa62363faff16162f48fa3
MD5 3812354d7a75182620cd085381eff71b
SHA1 ddecd0baf02e3ab955126793d054e371aa3f2732
SHA512 dfb4604fecb77b85eda538eb65eea1bbecb02ad0768d19ed56282584bf3ff0c738cf8fc8fb4a78622c77b98879c9425d8ef925e9ab192c76a5006976fded4938
SSDEEP 98304:p5HW9CD5DNgPHXSTSBqH6f0PeU/uCgEOtfJ/Zy:pcUD5DNYH2EkJgTJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detect Lumma Stealer payload V4
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2481903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Source RenewalPT\SrcGame\src\Release\Game.pdb

dsound

ord1

kernel32

GetPrivateProfileStringA CreateDirectoryA WriteFile OutputDebugStringA GetCurrentDirectoryA CreateProcessA WritePrivateProfileStringA SetFilePointer VirtualProtect VirtualQuery GlobalAlloc GetTickCount64 GetComputerNameA SuspendThread ResumeThread CopyFileA WaitForSingleObject SetThreadPriority TerminateThread GetExitCodeThread _lopen _lcreat _lread _lwrite _lclose CompareFileTime GlobalUnlock GlobalLock GlobalHandle GlobalFree MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte LocalAlloc LocalFree MapViewOfFile UnmapViewOfFile CreateFileMappingA TerminateProcess GetVersionExA SetEndOfFile HeapSize CreateFileW SetStdHandle OutputDebugStringW SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP CreateThread FindNextFileW FindFirstFileExW FindNextFileA HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetStdHandle GetModuleFileNameW GetModuleHandleExW LoadLibraryExW FreeLibrary InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread SetLastError DecodePointer EncodePointer FormatMessageW GetLastError InitializeSListHead GetSystemTimeAsFileTime FindClose ExitProcess GetFileSize ReadFile FindFirstFileA lstrcmpiA lstrcmpA lstrcatA ExitThread GetCurrentThread Sleep Module32Next Module32First Thread32Next Thread32First GetCurrentProcessId GetCurrentProcess DeleteCriticalSection LeaveCriticalSection EnterCriticalSection QueryPerformanceCounter WriteConsoleW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount CreateToolhelp32Snapshot lstrlenA lstrcpyA lstrcpynA LoadLibraryA GetProcAddress GetModuleHandleA GetModuleFileNameA FreeLibraryAndExitThread GetTickCount OpenThread GetPrivateProfileIntA GetTimeZoneInformation InitializeCriticalSection DuplicateHandle CloseHandle IsDebuggerPresent GetLocalTime DeleteFileA CreateFileA GetCurrentThreadId IsValidCodePage

user32

SetMenu LoadMenuA CheckMenuItem EnableMenuItem SetForegroundWindow CreateMenu GetMenu LoadIconA DestroyIcon SetWindowPos GetAsyncKeyState AdjustWindowRect SetWindowLongA CharToOemA OemToCharA CharUpperA GetWindowTextA FindWindowA GetSystemMetrics wsprintfA CharLowerA EnumWindows GetClassNameA GetDC ReleaseDC SetWindowTextA GetClientRect ClientToScreen OffsetRect SendMessageA GetKeyState MessageBoxA LoadKeyboardLayoutA GetKeyboardLayoutNameA TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage PostMessageA CallWindowProcA SetFocus GetForegroundWindow AdjustWindowRectEx ShowCursor GetWindowLongA SetTimer GetWindow RegisterClassA CreateWindowExA DestroyWindow ShowWindow CreateDialogParamA GetDlgItem WaitMessage UpdateWindow LoadCursorA

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateDCA DeleteDC DeleteObject GetDIBits SelectObject GetObjectA SetBkMode GetStockObject SetTextColor GetTextColor CreateSolidBrush BitBlt

advapi32

RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyA

shell32

ShellExecuteA Shell_NotifyIconA

ole32

CoCreateInstance CoUninitialize CoInitialize

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateFontA D3DXCreateTextureFromFileInMemoryEx D3DXGetImageInfoFromFileInMemory

winmm

mmioClose timeBeginPeriod mmioWrite mmioGetInfo mmioSetInfo mmioOpenA timeEndPeriod timeKillEvent mixerGetControlDetailsA timeSetEvent timeGetTime mmioRead mmioAdvance mmioDescend mmioAscend mmioCreateChunk mixerGetDevCapsA mixerOpen mixerClose mixerGetLineInfoA mixerGetLineControlsA mixerSetControlDetails mmioSeek

shlwapi

PathFileExistsA

msvfw32

ICDecompress ICSendMessage ICClose ICLocate

avifil32

AVIStreamInfoA AVIStreamOpenFromFileA AVIStreamRelease AVIStreamRead AVIFileExit AVIStreamLength AVIStreamReadFormat AVIFileInit

wininet

InternetOpenUrlA InternetCloseHandle InternetReadFile HttpQueryInfoA InternetOpenA

iphlpapi

GetAdaptersInfo

wsock32

closesocket ioctlsocket WSACleanup accept bind connect inet_ntoa htons inet_addr select __WSAFDIsSet WSAAsyncSelect WSAGetLastError WSAStartup gethostname gethostbyname socket setsockopt send recv listen

imm32

ImmSetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListA ImmGetDescriptionA ImmGetCompositionStringA ImmReleaseContext ImmGetContext ImmGetProperty ImmGetCandidateListCountA