Try VMRay Platform
Malicious
Classifications

Spyware

Threat Names

Lumma C2/Generic-A Mal/Generic-S Mal/HTMLGen-A +1

Remarks (1/1)

(0x02000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

Filters:
File Name Category Type Verdict Actions
C:\Users\RDhJ0CNFevzX\Desktop\LummaC2.exe Sample File Binary
Malicious
»
MIME Type application/vnd.microsoft.portable-executable
File Size 320.56 KB
MD5 0fe84122dd3924cad9d2786ed45de9ba Copy to Clipboard
SHA1 a9673fe7188dc623dede0c3a3788acff248e2c0a Copy to Clipboard
SHA256 b20b3abfefc9b3344ad1171f18b9ce80db3b092fb64b5b4f2da766d46481a67a Copy to Clipboard
SSDeep 6144:a3VUD8LkbASEQJYMm+l0s0UddmR6ZPcF3tVOTjoBwS0vE:auDYkbAtQJ30udEyPq3iTjo2L Copy to Clipboard
ImpHash 9afa74f09d19900a85844b7a585219b4 Copy to Clipboard
File Reputation Information
»
Verdict
Malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x00400000
Entry Point 0x00408730
Size Of Code 0x00044C00
Size Of Initialized Data 0x0000B200
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_I386
Compile Timestamp 2025-01-02 19:58 (UTC)
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x00401000 0x00044B02 0x00044C00 0x00000400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.62
.rdata 0x00446000 0x000023EB 0x00002400 0x00045000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 6.9
.data 0x00449000 0x0000D57C 0x00005200 0x00047400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 6.48
.reloc 0x00457000 0x00003C00 0x00003C00 0x0004C600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.52
Imports (6)
»
KERNEL32.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CreateProcessW - 0x00448044 0x00047F84 0x00046F84 0x000000E8
CreateThread - 0x00448048 0x00047F88 0x00046F88 0x000000F6
ExitProcess - 0x0044804C 0x00047F8C 0x00046F8C 0x00000162
GetCommandLineW - 0x00448050 0x00047F90 0x00046F90 0x000001DB
GetCurrentProcessId - 0x00448054 0x00047F94 0x00046F94 0x0000021C
GetCurrentThreadId - 0x00448058 0x00047F98 0x00046F98 0x00000220
GetLogicalDrives - 0x0044805C 0x00047F9C 0x00046F9C 0x0000026C
GlobalLock - 0x00448060 0x00047FA0 0x00046FA0 0x00000344
GlobalUnlock - 0x00448064 0x00047FA4 0x00046FA4 0x0000034B
SHELL32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SHGetFileInfoW - 0x0044806C 0x00047FAC 0x00046FAC 0x0000014A
SHGetSpecialFolderPathW - 0x00448070 0x00047FB0 0x00046FB0 0x0000016E
USER32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CloseClipboard - 0x00448078 0x00047FB8 0x00046FB8 0x0000004F
GetClipboardData - 0x0044807C 0x00047FBC 0x00046FBC 0x00000134
GetDC - 0x00448080 0x00047FC0 0x00046FC0 0x00000140
GetForegroundWindow - 0x00448084 0x00047FC4 0x00046FC4 0x00000157
GetSystemMetrics - 0x00448088 0x00047FC8 0x00046FC8 0x000001C6
GetWindowLongW - 0x0044808C 0x00047FCC 0x00046FCC 0x000001E6
OpenClipboard - 0x00448090 0x00047FD0 0x00046FD0 0x00000298
ReleaseDC - 0x00448094 0x00047FD4 0x00046FD4 0x000002F7
GDI32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
BitBlt - 0x0044809C 0x00047FDC 0x00046FDC 0x00000013
CreateCompatibleBitmap - 0x004480A0 0x00047FE0 0x00046FE0 0x00000030
CreateCompatibleDC - 0x004480A4 0x00047FE4 0x00046FE4 0x00000031
CreateDIBSection - 0x004480A8 0x00047FE8 0x00046FE8 0x00000037
DeleteDC - 0x004480AC 0x00047FEC 0x00046FEC 0x00000183
DeleteObject - 0x004480B0 0x00047FF0 0x00046FF0 0x00000186
GetCurrentObject - 0x004480B4 0x00047FF4 0x00046FF4 0x00000276
GetDIBits - 0x004480B8 0x00047FF8 0x00046FF8 0x0000027D
GetObjectW - 0x004480BC 0x00047FFC 0x00046FFC 0x000002B0
GetPixel - 0x004480C0 0x00048000 0x00047000 0x000002B7
SelectObject - 0x004480C4 0x00048004 0x00047004 0x00000367
StretchBlt - 0x004480C8 0x00048008 0x00047008 0x000003A3
ole32.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoCreateInstance - 0x004480D0 0x00048010 0x00047010 0x00000028
CoInitializeEx - 0x004480D4 0x00048014 0x00047014 0x0000005E
CoInitializeSecurity - 0x004480D8 0x00048018 0x00047018 0x0000005F
CoQueryClientBlanket - 0x004480DC 0x0004801C 0x0004701C 0x0000006D
CoSetProxyBlanket - 0x004480E0 0x00048020 0x00047020 0x00000084
CoTaskMemAlloc - 0x004480E4 0x00048024 0x00047024 0x00000088
CoUninitialize - 0x004480E8 0x00048028 0x00047028 0x0000008E
OLEAUT32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SysAllocString 0x00000002 0x004480F0 0x00048030 0x00047030 -
SysFreeString 0x00000006 0x004480F4 0x00048034 0x00047034 -
VariantClear 0x00000009 0x004480F8 0x00048038 0x00047038 -
VariantInit 0x00000008 0x004480FC 0x0004803C 0x0004703C -
Memory Dumps (6)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
lummac2.exe 1 0x00B70000 0x00BCAFFF Relevant Image False 32-bit 0x00BAD5C0 False
buffer 1 0x0018C000 0x0018FFFF First Network Behavior False 32-bit - False
buffer 1 0x006CB6F0 0x006CD6EF First Network Behavior False 32-bit - False
buffer 1 0x006CFDC8 0x006D5317 First Network Behavior False 32-bit - False
lummac2.exe 1 0x00B70000 0x00BCAFFF First Network Behavior False 32-bit 0x00B79FA0 False
lummac2.exe 1 0x00B70000 0x00BCAFFF Process Termination False 32-bit - False
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
Lumma_Custom_Base64 Lumma custom base64 decoding Spyware
5/5
7e2d66ae33fb05655329be54dc3560c2d0f596452f22193f0750a36c121b5399 Downloaded File HTML
Clean
»
MIME Type text/html
File Size 34.74 KB
MD5 4f9297a13d771e1ce04c24d86d16f884 Copy to Clipboard
SHA1 06ed1ffa54fccb8ebe7f4c9ee264e456e698b475 Copy to Clipboard
SHA256 7e2d66ae33fb05655329be54dc3560c2d0f596452f22193f0750a36c121b5399 Copy to Clipboard
SSDeep 768:75pq/Ku4HmBC5ReOpznzQlF5aXfsW9l+X9hJYFn5OMF5CBHxaXfsW9l+X9hJYM27:758/Ku4HmBC5ReOpzna5aXfsW9l+X9hA Copy to Clipboard
ImpHash -
Static Analysis Parser Error HTML parser encountered errors
Extracted URLs (67)
»
URL WHOIS Data Reputation Status Recursively Submitted Actions
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Malicious
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Malicious
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Malicious
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
Show WHOIS
Not Available
89cc4ec4d3d08e39cc94782fb19a52005add532f7ef692d3679c9cef68c2f52d Downloaded File Text
Clean
»
MIME Type text/plain
File Size 18.39 KB
MD5 d51e60ff22d9f9684da108d3c8e2c033 Copy to Clipboard
SHA1 866b547f5f3c7cb2d626cd8d78d60292620f17fe Copy to Clipboard
SHA256 89cc4ec4d3d08e39cc94782fb19a52005add532f7ef692d3679c9cef68c2f52d Copy to Clipboard
SSDeep 384:eCML77eYzv+UsmFgX/KpgShC34QQj2mDtDralq5Hc4vDEerVqSRGncIS:eLH7eKv+UPV5hM+2qralqFDTJYncV Copy to Clipboard
ImpHash -
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\YYVN4TBXEDY7BKUXIITBJB4VU4FIL.ps1 Downloaded File HTML
Clean
»
MIME Type text/html
File Size 4.34 KB
MD5 d01eb1f73880f942f886b9b7cf3960c8 Copy to Clipboard
SHA1 4c3e3adff0e6182fed20136c7ae81c3e6f1883c2 Copy to Clipboard
SHA256 a6f74f2017b35cc00b9c6619b6e024cebb032f0927a4da8b435399aaf9ad18a3 Copy to Clipboard
SSDeep 48:5q41lJM8WOxEj4/wPsAG4oevjKEcXrCnBBkpBxVGLrGWqSTw2wptI8Id6Pu:5hPA5jKEcXrCnTkpBxF1nx/ICu Copy to Clipboard
ImpHash -
Extracted URLs (1)
»
URL WHOIS Data Reputation Status Recursively Submitted Actions
Show WHOIS
Not Available
11503cb70e6ebd3c2a7582626095db93c0a01deb82cfc3ac08ccc189efce0277 Downloaded File Stream
Clean
»
MIME Type application/octet-stream
File Size 1.51 KB
MD5 5cbc6b85e3927afe4c865a41c6a724f2 Copy to Clipboard
SHA1 a2ffe51cfb382d5e541bf9bb88695863d7920a41 Copy to Clipboard
SHA256 11503cb70e6ebd3c2a7582626095db93c0a01deb82cfc3ac08ccc189efce0277 Copy to Clipboard
SSDeep 24:kUOH3p+XtTvcXQDLaNt/qjN1a2dzBiaKLUOk5TQHqa1Cl/H:t0iTvJDeNsj3PttOkcJUl/H Copy to Clipboard
ImpHash -
27a22c238c66a8b5b4f58e1887119ee5f55b9cba364efb7c8372b34acad90b0b Downloaded File Text
Clean
»
MIME Type text/plain
File Size 120 Bytes
MD5 bcd62cda009cf6ce792005ab78ddfbfa Copy to Clipboard
SHA1 6eadec22d13de1f709b7fbbf8259ad792f20331a Copy to Clipboard
SHA256 27a22c238c66a8b5b4f58e1887119ee5f55b9cba364efb7c8372b34acad90b0b Copy to Clipboard
SSDeep 3:Vc0R4QqOoRrXQuNkqdqwmi8oTsSh0VxHngxs7p19scvKt:Vpq5RrAqkAqI8UsSh0fngi7DKcU Copy to Clipboard
ImpHash -
6113445002625a377f23b4b3cae970f91ee4283887b6ab19eb886456e525b425 Downloaded File Text
Clean
»
MIME Type text/plain
File Size 85 Bytes
MD5 be77016a67225509274f5036b63f6566 Copy to Clipboard
SHA1 239e0c04793113194f7c4d2415a6533f1ddb8f98 Copy to Clipboard
SHA256 6113445002625a377f23b4b3cae970f91ee4283887b6ab19eb886456e525b425 Copy to Clipboard
SSDeep 3:vRYR69RrJMboIqDITSDCSAlRjdoZdzUdK:JYR8Rt4oIqySUnoZGw Copy to Clipboard
ImpHash -
ce528fdc5093be3f3184ffaf605c38bbaf0c892d57570e1e18e5ca2f5661be84 Downloaded File Text
Clean
»
MIME Type text/plain
File Size 50 Bytes
MD5 914a38b2ceb29bb952b187bf52b00fe6 Copy to Clipboard
SHA1 8b4af0c96b80e3dd7e7343ea3106904320c2d5e7 Copy to Clipboard
SHA256 ce528fdc5093be3f3184ffaf605c38bbaf0c892d57570e1e18e5ca2f5661be84 Copy to Clipboard
SSDeep 3:vR/M6ECJMboIqDITSDY:Jk84oIqySE Copy to Clipboard
ImpHash -
04339c5b1cd2339b03ffd50bc302c17f6c3ea7a39abbe96dd4ea5ad6d9796764 Downloaded File Text
Clean
»
MIME Type text/plain
File Size 8 Bytes
MD5 faf57b74d4f3a37d109433c62e0d0fbd Copy to Clipboard
SHA1 b844716b8f45b1069bb05a63c94df160aeb7bfba Copy to Clipboard
SHA256 04339c5b1cd2339b03ffd50bc302c17f6c3ea7a39abbe96dd4ea5ad6d9796764 Copy to Clipboard
SSDeep 3:vRFc:Je Copy to Clipboard
ImpHash -
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Downloaded File Text
Clean
Known to be clean.
»
MIME Type text/plain
File Size 2 Bytes
MD5 444bcb3a3fcf8389296c49467f27e1d6 Copy to Clipboard
SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb Copy to Clipboard
SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Copy to Clipboard
SSDeep 3:V:V Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Clean
Known to be clean.
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image