MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04c0a81857162cc18343b292804d2f6bec491f3eeb3689b65c1b183fbfc74668. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 4 File information Comments

SHA256 hash:	04c0a81857162cc18343b292804d2f6bec491f3eeb3689b65c1b183fbfc74668
SHA3-384 hash:	621b0f8c99e6ca2d2d38e8acad6ced7b226eb62aeeed554c3c10c2b3c8bac62c13000bcaf2d2c9c1ab12e5f3d0e6b44d
SHA1 hash:	45270f0763014ddecf79835d74d4d58c8e12a7f2
MD5 hash:	e4b75a6ff6e98d0bea52df578221e2a5
humanhash:	table-jersey-iowa-early
File name:	08IyOOF.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'234'432 bytes
First seen:	2025-06-05 06:25:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f9f160ce0f0c454ba71d5ad40cc375c9 (24 x LummaStealer, 1 x Vidar)
ssdeep	24576:nSxGdss5tPmW4JSjfJBxYDBGd7EZVgL9UBj0gOS+zLUvbv:wGdRyWiSdvsBGhEZVGWNOovbv
Threatray	193 similar samples on MalwareBazaar
TLSH	T15A457D299142E1C6FC6A40B605B1A1A83462B733C63D2FFF8290E333AD07BD55B6975D
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

432

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

random.exe

Verdict:

Malicious activity

Analysis date:

2025-06-04 13:06:31 UTC

Tags:

amadey botnet stealer loader telegram lumma themida rdp miner silentcryptominer github evasion winring0x64-sys vuln-driver auto-reg vidar gcleaner

Link:

https://app.any.run/tasks/e138e676-5e68-47b2-8b12-b838ea0da90c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/7421/

Detection(s):

Win.Packed.Agen-10045321-0

Win.Packed.Agen-10045323-0

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68413bb08bd5d68a12e568e1

Tags:

virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Connection attempt to an infection source

DNS request

Connection attempt

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Forced shutdown of a system process

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint infostealer lumma microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/68413884fd02ed5e059941d0/reports/5b84c986-3d1a-4c2e-986e-bd2e2c89936f/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/04c0a81857162cc18343b292804d2f6bec491f3eeb3689b65c1b183fbfc74668

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/85ad9f54-de79-4b75-8e2c-b014525672b6

Result

Threat name:

LummaC Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1706903

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/04c0a81857162cc18343b292804d2f6bec491f3eeb3689b65c1b183fbfc74668

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/04c0a81857162cc18343b292804d2f6bec491f3eeb3689b65c1b183fbfc74668/

Threat name:

Win64.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-06-04 14:34:01 UTC

File Type:

PE+ (Exe)

AV detection:

30 of 38 (78.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=atakqgcxcywmda2dwkjiatjpnpweshz65m3itns4dmmd7p6hizua._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

076858a27b712af3e1e811f606e9cabb374490a5c0a983aea1000e1334179303

LummaStealer

211e989abb46301bb0bae2e358650951467febaca4a51ea73e60ca3e231e5c5d

LummaStealer

610b22833913e0be781d07739429f836fce8bdbe24088b2a9d06e530bc16ccac

LummaStealer

8a8689a5d75999f25e635fd0fc2a74785f0c79ebc15de4f340b4fdf4f37ff894

LummaStealer

e4879877a8f18a7fe1e814755edc0a039f62517df4dbd076ea4343042000742d

LummaStealer

error

LummaStealer

fafec872e4e681079981bee089865af4303c4e359b311b47c127e02f3faaa341

LummaStealer

+ 183 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/250605-g7f8esbl7t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://witchdbhy.run/pzal
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://tinklertjp.bet/nzaf
https://diecam.top/laur/api
https://citellcagt.top/gjtu

Verdict:

Malicious

Tags:

Win.Packed.Agen-10045321-0

YARA:

n/a

Link:

https://app.threat.zone/submission/853fd50b-060f-49f7-9395-cafa175eab64

Unpacked files

SH256 hash:

04c0a81857162cc18343b292804d2f6bec491f3eeb3689b65c1b183fbfc74668

MD5 hash:

e4b75a6ff6e98d0bea52df578221e2a5

SHA1 hash:

45270f0763014ddecf79835d74d4d58c8e12a7f2

Link:

https://www.unpac.me/results/01967f42-0dd5-435c-91a5-7c06cdb7fdec/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/04c0a8185716/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/04c0a81857162cc18343b292804d2f6bec491f3eeb3689b65c1b183fbfc74668

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)