lumma | 99c16944cf866e0a9222f700238a94d9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
99c16944cf866e0a9222f700238a94d9_JaffaCakes118
Size 4.9MB
Sample240606-cbs5wsfb74
SHA256 bd2f485c7e79cb069dca376acf19ac69cb365adb8fa7e6ea9697f51930e5b7e9
MD5 99c16944cf866e0a9222f700238a94d9
SHA1 38d1426d676baa74e08d78b1a63d09d2fe94735f
SHA512 3346c1bd4e5ca2bfe7836a27771ab246731aef1f5eb9a581c4f6e44d0641b0201c6bd60efa0f1f6484c8ce8a9fab9fc7c7e1b469242adb15fde59be89add3b96
SSDEEP 49152:H3ZKwaIejrKlURbgVXkBBFflxHNFKEFTYvyGVAmwj2UDqmAlXdWolk9Oh9Pab:HpKwaFWlURbnBYyGVAX2U+W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma

Malware Config

Signatures

Detect Lumma Stealer payload V4 1 IoCs

resource	yara_rule
sample	family_lumma_v4

Lumma family
lumma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99c16944cf866e0a9222f700238a94d9_JaffaCakes118

File Explorer

99c16944cf866e0a9222f700238a94d9_JaffaCakes118

.exe 4.9MB

99c16944cf866e0a9222f700238a94d9_JaffaCakes118

IMPHASH eae70fcb5a1d4d818a49b782f1eb6a05
SHA256 bd2f485c7e79cb069dca376acf19ac69cb365adb8fa7e6ea9697f51930e5b7e9
MD5 99c16944cf866e0a9222f700238a94d9
SHA1 38d1426d676baa74e08d78b1a63d09d2fe94735f
SHA512 3346c1bd4e5ca2bfe7836a27771ab246731aef1f5eb9a581c4f6e44d0641b0201c6bd60efa0f1f6484c8ce8a9fab9fc7c7e1b469242adb15fde59be89add3b96
SSDEEP 49152:H3ZKwaIejrKlURbgVXkBBFflxHNFKEFTYvyGVAmwj2UDqmAlXdWolk9Oh9Pab:HpKwaFWlURbnBYyGVAX2U+W
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detect Lumma Stealer payload V4
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2696324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\DEVS\Clientes\YouLose\Source\SrcGame\src\Release\game.pdb

dsound

ord1

kernel32

CreateFileA FindFirstFileA ReadFile GetFileSize GetSystemDirectoryA ExitProcess FindClose FindNextFileA GetCurrentDirectoryA GetPrivateProfileIntA GetPrivateProfileStringA CreateDirectoryA WriteFile GetLocalTime OutputDebugStringA CreateProcessA WritePrivateProfileStringA SetFilePointer GlobalAlloc GetComputerNameA SuspendThread DeleteFileA ResumeThread CopyFileA InitializeCriticalSectionAndSpinCount WaitForSingleObject SetThreadPriority TerminateThread GetExitCodeThread _lopen _lcreat _lread _lwrite _lclose CompareFileTime GlobalUnlock GlobalLock GlobalHandle GlobalFree MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte LocalAlloc LocalFree MapViewOfFile UnmapViewOfFile CreateFileMappingA TerminateProcess GetVersionExA SetEndOfFile CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetConsoleCtrlHandler GetTimeZoneInformation lstrcmpiA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW SetFilePointerEx GetFileSizeEx GetConsoleCP ReadConsoleW GetConsoleMode GetFileType GetStdHandle GetModuleFileNameW GetModuleHandleExW LoadLibraryExW FreeLibrary InterlockedFlushSList InterlockedPushEntrySList RtlUnwind OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetModuleHandleW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread LoadLibraryA GetProcAddress GetModuleHandleA GetModuleFileNameA FreeLibraryAndExitThread GetTickCount OpenThread GetCurrentThreadId CreateThread GetCurrentProcessId GetCurrentProcess LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrcmpA DuplicateHandle CloseHandle IsDebuggerPresent DeleteCriticalSection InitializeCriticalSectionEx CreateEventW SetLastError FormatMessageA lstrcatA ExitThread GetCurrentThread Sleep WriteConsoleW Module32Next Module32First Thread32Next Thread32First CreateToolhelp32Snapshot lstrlenA lstrcpyA FlushFileBuffers lstrcpynA DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap

user32

LoadKeyboardLayoutA MessageBoxA GetKeyState SendMessageA OffsetRect ClientToScreen GetKeyboardLayoutNameA TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA RegisterClassA CreateWindowExA DestroyWindow GetClientRect ShowWindow CreateDialogParamA GetDlgItem SetWindowTextA LoadCursorA WaitMessage PostQuitMessage SetTimer GetSystemMetrics LoadMenuA GetMenu SetMenu CreateMenu CheckMenuItem EnableMenuItem SetForegroundWindow LoadIconA DestroyIcon SetWindowPos GetAsyncKeyState AdjustWindowRect SetWindowLongA CharToOemA OemToCharA CharUpperA PostMessageA CallWindowProcA AdjustWindowRectEx ShowCursor GetWindowLongA ReleaseDC GetDC UpdateWindow UnregisterClassA GetClassNameA GetWindowTextA FindWindowA GetWindow wsprintfA EnumWindows CharLowerA

gdi32

CreateSolidBrush SetBkMode GetTextColor SetTextColor GetStockObject GetObjectA SelectObject GetDIBits DeleteDC CreateDCA CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject

advapi32

RegCloseKey RegDeleteValueA RegOpenKeyA RegCreateKeyExA

shell32

Shell_NotifyIconA ShellExecuteA

ole32

CoUninitialize CoCreateInstance CoInitialize

d3d9

Direct3DCreate9

d3dx9_43

D3DXGetImageInfoFromFileInMemory D3DXCreateTextureFromFileInMemoryEx D3DXCreateFontA

winmm

mixerOpen mixerClose mixerGetLineInfoA mixerGetLineControlsA mixerGetControlDetailsA mixerSetControlDetails mmioAdvance mmioSetInfo mmioCreateChunk mmioSeek mmioWrite mmioRead mmioClose mmioOpenA timeEndPeriod timeBeginPeriod timeKillEvent mmioAscend timeSetEvent mixerGetDevCapsA mmioDescend timeGetTime mmioGetInfo

shlwapi

PathFileExistsA

msvfw32

ICSendMessage ICDecompress ICLocate ICClose

avifil32

AVIStreamOpenFromFileA AVIStreamInfoA AVIStreamRelease AVIFileExit AVIFileInit AVIStreamRead AVIStreamLength AVIStreamReadFormat

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle InternetOpenA InternetReadFile HttpQueryInfoA InternetOpenUrlA

wsock32

ioctlsocket WSACleanup accept bind connect inet_ntoa htons inet_addr listen recv send setsockopt closesocket socket gethostbyname gethostname WSAStartup WSAGetLastError WSAAsyncSelect __WSAFDIsSet select

imm32

ImmGetDescriptionA ImmGetProperty ImmGetContext ImmReleaseContext ImmGetCompositionStringA ImmGetCandidateListCountA ImmGetCandidateListA ImmGetConversionStatus ImmSetConversionStatus ImmSetOpenStatus

generic

count=36, id=259, version=26715,

count=203, id=261, version=26715,

count=28, id=260, version=26715,

count=2, id=10, version=8966,

count=19, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=3, id=199, version=41118,

count=19, id=260, version=28619,

count=26, id=259, version=28619,

count=89, id=261, version=28619,

count=28, id=257, version=26715,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=310, id=1, productName=Unmarked objects,

count=171, id=261, productName=VS2019 v16.6.2 build 28806, version=28806,

count=1, id=255, productName=VS2019 v16.6.2 build 28806, version=28806,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.6.2 build 28806, version=28806,