MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08eda537ce2a39d5040f276ee9b0d9718843498ecdac533d0f8447401b50b341. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	08eda537ce2a39d5040f276ee9b0d9718843498ecdac533d0f8447401b50b341
SHA3-384 hash:	451da99929dd29b42b10f4fe4eac1abbc1926ecedf6d44666b1d0656622e8c9948f7d97b6d8b5c6c4f49b5b6e982f41a
SHA1 hash:	f7eb29970905c64131b444f74d6415591caff638
MD5 hash:	dfc5be4f22baed379a9e059744364541
humanhash:	magazine-princess-alaska-double
File name:	setup.zip
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	12'687'635 bytes
First seen:	2025-02-01 16:25:07 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:obqEVNRZcp8+TI7vCXa2+uCQRJF8RlZQWsGqBtqOwYDNkxwr5UXYl2:ob/ZcpE2K2+kZCSJGCxoSM
TLSH	T1A6D6336664A30F95C85D427985CF4B46338DAB1A8112D72B47B5F22FBFF77F09928802
Magika	zip
Reporter	aachum
Tags:	AutoIT file-pumped LummaStealer zip

iamaachum

https://secure.filenimbus.com/0MdWlkPTE0JmZpZD0zNWU1MQ => https://www.mediafire.com/file/mjhnbndqb773p29/#%F0%9D%93%9EpeN-Set-U%E1%B9%95__8559--Pa$$%F0%9D%93%9AeY@!.zip/file

Intelligence

File Origin

# of uploads :

# of downloads :

367

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	1'087'560'837 bytes
SHA256 hash:	e9d69675ec56f72930a0a7bc9f43a7cb36231d67ad1e71278943fd3426ae51a6
MD5 hash:	68004a5338fa74250030552fd699cfcb
De-pumped file size:	954'880 bytes (Vs. original size of 1'087'560'837 bytes)
De-pumped SHA256 hash:	e606469971f2f427cf61f50f89edeae4952bf3513a9f7727b61d9c643e31ad12
De-pumped MD5 hash:	26236333ca78d4cfba1ea8e25c19e070
MIME type:	application/x-dosexec
Signature	LummaStealer

Vendor Threat Intelligence

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=679e4b07416a81ccc3c4e3dd

Tags:

vmdetect phishing autoit emotet

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/08eda537ce2a39d5040f276ee9b0d9718843498ecdac533d0f8447401b50b341/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context bloated fingerprint invalid-signature large-file microsoft_visual_cc overlay signed

Link:

https://www.filescan.io/uploads/679e4af75dee18920075052a/reports/5462853d-8865-4279-9598-647463b98c01/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/08eda537ce2a39d5040f276ee9b0d9718843498ecdac533d0f8447401b50b341

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/08eda537ce2a39d5040f276ee9b0d9718843498ecdac533d0f8447401b50b341

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/08eda537ce2a39d5040f276ee9b0d9718843498ecdac533d0f8447401b50b341/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bdw2kn6ofi45kbape5xotmgzogeegsmozwwfgpipqrduag2qwnaq._file

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/250201-t4ddkszrev/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://toppyneedus.biz/api

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/08eda537ce2a39d5040f276ee9b0d9718843498ecdac533d0f8447401b50b341

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)