MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a
SHA3-384 hash: 4ca6dc662bd2d52b960518ea71095d548435b09f1f198c111c0ca650de44f6dcc65b8f0f492d87ebeb714b5efd5b21fd
SHA1 hash: c1c5e3296b73bb13f067c9ad76a366bf5d150e8d
MD5 hash: 1644dcf5ccf45c88151eef4432ac822b
humanhash: louisiana-october-wolfram-lemon
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'165'824 bytes
First seen:2025-09-16 04:01:23 UTC
Last seen:2025-09-17 04:16:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 44d8a197c84278da32b54956d7f26e65 (6 x LummaStealer, 1 x StormKitty, 1 x Vidar)
ssdeep 24576:jdnbERqg3AJnGk1hUxxBi5EtfNEW7RZ+JO8sT7IQr:OqgWnX1X5c8q7IQr
TLSH T18145E019E5B990D7FDE340B0A7095211E9337D678F246ADB42E48B90062BDED1B3E336
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe LummaStealer


Avatar
Bitsight
url: http://178.16.54.200/files/fate/random.exe

Intelligence

File Origin
# of uploads :
8
# of downloads :
131
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
http://178.16.54.200/download.php
Verdict:
Malicious activity
Analysis date:
2025-09-15 20:49:09 UTC
Tags:
loader auto redline stealer amadey lumma botnet credentialflusher python github winring0-sys vuln-driver xmrig miner themida rdp arch-exec gcleaner evasion purelogs purecrypter stealc payload vidar coinminer pyinstaller telegram api-base64 netreactor zgrat crypto-regex purehvnc generic rhadamanthys
Link:
https://app.any.run/tasks/948277b9-10b9-40d8-a81a-abc886149a0c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27633/
Detection(s):
Win.Packed.Lazy-10057857-0
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c89ad7d49ea3f1e4b632f8
Tags:
stealer virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc obfuscated packed packed packer_detected similar-threat
Link:
https://www.filescan.io/uploads/68c8e13c73287948292b5584/reports/1886105d-4a27-4f99-beab-00d0041f0c2b/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-15T13:39:00Z UTC
Last seen:
2025-09-15T13:39:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Stealerc.HTTP.C&C Trojan-PSW.Lumma.TCP.C&C Trojan.Win32.InjectorNetT.cjw PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3d5fcdf7-f637-4919-a430-be02d5cf04ce
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/1644dcf5ccf45c88151eef4432ac822b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a
Threat name:
Win64.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-09-15 19:47:30 UTC
File Type:
PE+ (Exe)
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=az5ezn42fvqc3qpzaa7plbowaghvh7l62idknvebi4d2pwp5x6fa._file
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/250916-elzfrszydv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://t.me/romalaba
https://consnbx.su/sawo
https://yunded.com/uwuz
https://sirhirssg.su/xzde
https://prebwle.su/xazd
https://rhussois.su/tatr
https://todoexy.su/xqts
https://acrislegt.su/tazd
https://averiryvx.su/zadr
https://cerasatvf.su/qtpd
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5889a32c-436f-4a4d-a276-e2a3b998b218
Unpacked files
SH256 hash:
067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a
MD5 hash:
1644dcf5ccf45c88151eef4432ac822b
SHA1 hash:
c1c5e3296b73bb13f067c9ad76a366bf5d150e8d
Link:
https://www.unpac.me/results/314e8ebf-4f9a-4ab0-93ef-17b1544e684b/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/067a4cb79a2d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 067a4cb79a2d602dc1f9003ef585d6018f53fd7ed206a6d4814707a7d9fdbf8a

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3617790/
Cape
Cape
https://www.capesandbox.com/analysis/27633/

Comments