MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 10

Intelligence 10 IOCs 2 YARA 100 File information Comments

SHA256 hash:	093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9
SHA3-384 hash:	3e69edbdb56d3bc7eb918f7296fc6517e6789632cce7f892615ae6c4cbb624efeed48a0fb2a7540410141c3afbda676a
SHA1 hash:	b3fb7bc8956d1731e25be470e8298dc88d0a4aa2
MD5 hash:	4a8515b700d162e2d5a2093c4944b851
humanhash:	item-triple-finch-double
File name:	093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	21'537'173 bytes
First seen:	2026-06-05 06:57:16 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	393216:AGy+fGmFYym1Phba4gsmnbiRKeIJj9AqwWRSY44x+34D:6WTZmLb4bEKJge3fxND
TLSH	T1E627338C0B604B2847AA69242FA581DA6FD285D02EE7F3053265E4BCC7FD065527EFF1
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	JAMESWT_WT
Tags:	Click-Hijacking-TDS ClipBanker LummaStealer rar RemusStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://endlessgrumbler.cc:8080/updater?for=5120D3FEDD36EAC912DB54C863CE59BB	https://threatfox.abuse.ch/ioc/1744359/
196.251.107.104:1912	https://threatfox.abuse.ch/ioc/1735376/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 14 file(s), sorted by their relevance:

File name:	btZfO26.exe
File size:	2'075'624 bytes
SHA256 hash:	efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce
MD5 hash:	cd68bfc6475f0ac4f5d0994350b210cb
MIME type:	application/x-dosexec
Signature	Smoke Loader

File name:	rVYGceP.exe
File size:	6'761'936 bytes
SHA256 hash:	30424b733fe17e1e601f5c2ddbd75a0979909835356d5d1e7bb27182da11ea13
MD5 hash:	33b68203279605561e7384f2d406c289
MIME type:	application/x-dosexec
Signature	GoProxy

File name:	LdlY2ri.exe
File size:	1'848'832 bytes
SHA256 hash:	cd1c4a472f2b3d626cf59755ca4a86808f913f0da15a6b4c7632e9b68e0ab361
MD5 hash:	1fec5f183f1139592f617331386cac0e
MIME type:	application/x-dosexec
Signature	RemusStealer

File name:	Cia2O5x.exe
File size:	2'613'248 bytes
SHA256 hash:	038da7941cb395df589983f3b09346694fe2a3a9e458a295ebfd5bd7c9fdb434
MD5 hash:	802aa7a4a57b22e797ebeb2b3b638527
MIME type:	application/x-dosexec
Signature	QuasarRAT

File name:	request.exe
File size:	788'992 bytes
SHA256 hash:	d9db8bdad5edd37400bb6b885f65a0aee158c8b6e3f517e8de9c6a114e3a40be
MD5 hash:	cca25e0ed7f8326f06a45e3163ccfd20
MIME type:	application/x-dosexec
Signature	LummaStealer

File name:	kRHhLlh.exe
File size:	2'120'240 bytes
SHA256 hash:	809df87e75b0f659f2e4017692b1c66418fb6b458b7cf43b6ee918de14cf6ca1
MD5 hash:	697880f1e9dd872a1f78d7cd2ae6dbfc
MIME type:	application/x-dosexec
Signature	RemusStealer

File name:	build.exe
File size:	307'712 bytes
SHA256 hash:	90223a0bf3a14fc840cc51baeced06fd17a7853a52537ab84fbeab4d050e5b90
MD5 hash:	d17a39209828a2033375cd59759b8f64
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	lZDeIYoXVz.exe
File size:	2'915'392 bytes
SHA256 hash:	3e153a7edb74f3950d50bcf968418184648a7f195fd81268f77525e9b97c6960
MD5 hash:	6b5781eb6d94c66693cddd463e86ab25
MIME type:	application/x-dosexec
Signature	LummaStealer

File name:	random.exe
File size:	5'437'671 bytes
SHA256 hash:	c2cd34c0f4295339c1d611c5a9a4847be9da704e3454fe781f4af47540c0bb9d
MD5 hash:	ab7bedfaddd68182ccc6d808c847dde8
MIME type:	application/x-dosexec
Signature	SalatStealer

File name:	candy.exe
File size:	62'464 bytes
SHA256 hash:	863f8e761905985d4cba870b9aec44982cceb6209c05e72707522fd96e2d4e18
MD5 hash:	232e46f901d460af1d8a76c51d999f44
MIME type:	application/x-dosexec
Signature	LummaStealer

File name:	Loader.exe
File size:	368'128 bytes
SHA256 hash:	ec7c5533adfb5a919951a4973983064b2103918bcf9f93a8c351a152a1f63567
MD5 hash:	c59018845439dad4d30557ce61315e75
MIME type:	application/x-dosexec
Signature	ClipBanker

File name:	EBoost.exe
File size:	2'360'864 bytes
SHA256 hash:	b77f9f6a63826c6a207fb1a14f9caa977487b8b63b44aeeb4a0932b3748926e2
MD5 hash:	b7515b063de3e43ca243de5e5b36f5ab
MIME type:	application/x-dosexec
Signature	LummaStealer

File name:	hhKfuYso.exe
File size:	3'759'104 bytes
SHA256 hash:	d7cd4233c352a34f396bc7176434e7e1c993cdc67fcffd96df8c06c02d7f671c
MD5 hash:	76ef06ca158775e7c8d1245cea23c950
MIME type:	application/x-dosexec
Signature	LummaStealer

File name:	StatedPanasonic.exe
File size:	1'929'216 bytes
SHA256 hash:	3a4440ce511cc7583d97e3cc2583bc456107d4c2fa562f11ecfb4ee89cb221c2
MD5 hash:	dc91c99b0510aa1199bf9bdde4e77318
MIME type:	application/x-dosexec
Signature	LummaStealer

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c7099149-b55c-4e32-a4d0-cd664ebf3fc2/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a22736757b7bf261d611178

Tags:

injection phishing obfusc virus

Verdict:

Suspicious

Labled as:

Trojan.Kryptik

Link:

https://www.hybrid-analysis.com/sample/093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9

Verdict:

Malicious

File Type:

rar

First seen:

2026-02-11T17:25:00Z UTC

Last seen:

2026-06-06T22:13:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Vimditator.nerr Trojan.Win32.Injuke.plgi Trojan-Banker.Win32.Express.aes HEUR:Trojan.Win64.Agent.pef Trojan.Win32.AntiAV.ddnw Trojan-PSW.Win32.Lumma.abac HEUR:Trojan.Win64.Agent.gen HEUR:Trojan-Spy.MSIL.Stealer.gen HEUR:Exploit.MSIL.BypassUAC.c Trojan-PSW.Win32.Lumma.aama Trojan-PSW.MSIL.Reline.aauz Trojan-Banker.MSIL.Evital.gen Backdoor.Win32.Agent.myxdjt Trojan.Win64.Agent.smflzj Trojan.Script.ObfAU.gen

Link:

https://opentip.kaspersky.com/093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9/results?tab=lookup

Gathering data

Verdict:

Malicious

Threat:

Family.CLIPBANKER

Link:

https://tip.neiki.dev/file/093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9

Threat name:

Win64.Trojan.RedlineStealer

Status:

Malicious

First seen:

2026-02-11 04:00:33 UTC

File Type:

Binary (Archive)

Extracted files:

202

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=be7zytqwxr2vg2636ixzrgicr7v7wqtwlj7zfvtjtozbfp26p74q._file

Result

Malware family:

vidar

Score:

10/10

Tags:

family:goproxy family:lumma family:redline family:remus_stealer family:vidar botnet:8933992da57f6c208003d956c695e417 botnet:ddwwnnll backdoor costura defense_evasion discovery execution infostealer installer packer persistence privilege_escalation spyware stealer upx

Link:

https://tria.ge/reports/260605-hxvhqsds8p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Browser Information Discovery

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Reads user/profile data of web browsers

Malware Config

C2 Extraction:

196.251.107.104:1912
https://telegram.me/dikkh0k
https://steamcommunity.com/profiles/76561198742377525
https://unchewq.cyou
https://whitepepper.su/asds
https://hammernew.su/asdase
https://heavylussy.su/ccvfd
https://broguenko.su/asfase
https://homuncloud.su/ascasef
https://familyriwo.su/fssdaw
https://izzardtow.su/cascasc
https://basilicros.su/asdasq
https://chuckyr.cyou
https://oculusr.cyou

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/093f9c4e16bc75536bdbf22f9899028febfb42765a7f92d6699bb212bf5e7ff9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Any_SU_Domain Create hunting rule
Author:	you
Description:	Detect any reference to .su domains or subdomains

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Golang_Binary Create hunting rule
Author:	Andrew Morrow
Description:	Detects binaries compiled with Go

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	detect_Redline_Stealer_V2 Create hunting rule
Author:	Varp0s

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	GenericRedLineLike Create hunting rule
Author:	Still
Description:	Matches RedLine-like stealer; may match its variants.

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	goLangMatch3 Create hunting rule

Rule name:	goLangMatch4 Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_EXE_Packed_Fody Create hunting rule
Author:	ditekSHen
Description:	Detects executables manipulated with Fody

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	INDICATOR_SUSPICIOUS_ReflectiveLoader Create hunting rule
Author:	ditekSHen
Description:	Detects Reflective DLL injection artifacts

Rule name:	MALWARE_Win_MetaStealer Create hunting rule
Author:	ditekSHen
Description:	Detects MetaStealer infostealer

Rule name:	MAL_packer_lb_was_detected Create hunting rule
Author:	0x0d4y
Description:	Detect the packer used by Lockbit4.0

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	ProgramLanguage_Rust Create hunting rule
Author:	albertzsigovits
Description:	Application written in Rust programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	RedLine_Stealer_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Detecting unpacked Redline

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TelegramAPIMalware_PowerShell_EXE Create hunting rule
Author:	@polygonben
Description:	Hunting for pwsh malware using Telegram for C2

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	win32_dotnet_form_obfuscate Create hunting rule
Author:	Reedus0
Description:	Rule for detecting .NET form obfuscate malware

Rule name:	win32_redline_stealer Create hunting rule
Author:	Reedus0
Description:	Rule for detecting RedLine Stealer malware

Rule name:	Windows_Generic_Threat_efdb9e81 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Generic_40899c85 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_RedLineStealer_6dfafd7b Create hunting rule
Author:	Elastic Security

Rule name:	win_quasar_rat_client Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in Quasar Rat Samples.

Rule name:	win_redline_stealer_generic Create hunting rule
Author:	dubfib

Rule name:	win_stealer_generic Create hunting rule
Author:	Reedus0
Description:	Rule for detecting generic stealer malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample