MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099
SHA3-384 hash: f1cbce2a34fbdecf912dc9a8dc8c6a43d5ce319dce4de9bc8d9289b171e95446dd46fb4b88e2237fa70b0595a837c779
SHA1 hash: 288c737441c0f496ff3443d0ead2280c7f6fc9f4
MD5 hash: 35453f5209ffd9e3ab165e76f4138824
humanhash: fifteen-saturn-spaghetti-equal
File name:MOD_MENU.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'361'408 bytes
First seen:2025-08-19 10:15:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 47d46ce0699d66fc655f27ce58653f77 (14 x LummaStealer, 2 x Stealc, 1 x Amadey)
ssdeep 24576:tRaP10vxZsz3mb0rHoTS6a2Em88LMLfxIXZaKlA3FfmsFPe:tRagx2zWgrHgS6L5ML5yZRlA3p1FPe
Threatray 492 similar samples on MalwareBazaar
TLSH T1E455D019A87A91DAFCD340F12B5A9111F423BD37CF382EEB81E4A7601556DED093E236
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter burger
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MOD_MENU.exe
Verdict:
Malicious activity
Analysis date:
2025-08-19 10:15:45 UTC
Tags:
lumma stealer
Link:
https://app.any.run/tasks/43c99eb5-0239-48de-9526-a4229fed459c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lumma
Create hunting rule
Link:
https://www.capesandbox.com/analysis/22141/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a44eef8fd55a79c5292ad3
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Connection attempt to an infection source
Creating a window
Sending a custom TCP request
DNS request
Behavior that indicates a threat
Connection attempt
Query of malicious DNS domain
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/68a44f10a4bdac9f5b9e0eca/reports/82f93262-f231-41f7-950e-05d42efda7ce/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6352de3e-78aa-4399-a7f5-43d7e552ebf1
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1760043
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Silenttrinity Stager Msbuild Activity
Suricata IDS alerts for network traffic
Writes to foreign memory regions
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/35453f5209ffd9e3ab165e76f4138824
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099
Threat name:
Win64.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2025-08-18 21:08:54 UTC
File Type:
PE+ (Exe)
AV detection:
27 of 38 (71.05%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=acpf2qkterk6hhncygkk4saajs5dwkiyybi74d2qieibup5nkcmq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099
LummaStealer
264a338f67f094d0919fc7bccce2fd271239c377aa54d29c52beb13ee1505f4a
LummaStealer
31ba8080813690f32ff5cb3ad9c09a20129f81f0f4f11ed99d6cac35cb1d7c4d
LummaStealer
66714b3368a2365b0ac7cb6a09bf95dc6fb98989a74bcd2e274971b4237e6df7
LummaStealer
90dd3230318e9f79e3e346e0d9a2101ef4b4d056624591fcc77254d8976ecb1e
LummaStealer
9271db698491968a31a290e36a7a7fde9aa14692106798a89d0d320b6da35aa0
LummaStealer
b303e5fa63277691ab5249294772aed02d0f294fe2d69dc5dfe2cc77a15a4e7a
LummaStealer
error
LummaStealer
+ 482 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/250819-ma3ytaar31/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Enumerates connected drives
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://vaganetka.ru/opza
https://mastwin.in/qsaz
https://ordinarniyvrach.ru/xiur
https://yamakrug.ru/lzka
https://vishneviyjazz.ru/neco
https://yrokistorii.ru/uqya
https://stolewnica.ru/xjuf
https://visokiywkaf.ru/mmtn
https://kletkamozga.ru/iwyq
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c306d6b6-efb2-4c6f-8b66-c761b52a2ba1
Unpacked files
SH256 hash:
009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099
MD5 hash:
35453f5209ffd9e3ab165e76f4138824
SHA1 hash:
288c737441c0f496ff3443d0ead2280c7f6fc9f4
Link:
https://www.unpac.me/results/abbd100d-b06e-4319-a53e-64f893d0c4d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/009e5d41532455e39da2c194ae48004cba3b2918c051fe0f5041101a3fad5099

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/22141/

Comments