MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a92ab70d1e5725ecabf5b90be95d2a4522b5080158818154e2d6dc978bc7e65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0a92ab70d1e5725ecabf5b90be95d2a4522b5080158818154e2d6dc978bc7e65
SHA3-384 hash:	57fd7e950526b9c0fcc37f84d9456542abc07b436f1483b1d1710af639648775a3e0cea87f0837df89803613594c31e5
SHA1 hash:	f319594810604769a152ea224453e785dcde634f
MD5 hash:	92aaaf4173094053383fc0f66d21b168
humanhash:	hawaii-twenty-echo-blue
File name:	0a92ab70d1e5725ecabf5b90be95d2a4522b5080158818154e2d6dc978bc7e65
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	15'759'040 bytes
First seen:	2025-03-02 08:51:53 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	49152:N+h+DT+De2+De5/+De56D+De56sD+De56seG+De56se/B+De56se/4O+De56se/Q:D
TLSH	T1BEF67BD7679C07EDAB984CDE8109395764E2C17B2C6F1388A9E25907F03FD11B62AB70
Magika	powershell
Reporter	struppigel
Tags:	Emmenhtal LummaLoader LummaStealer ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

224

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.6948.15799.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a1e6b151193558eb195624

Tags:

ransomware scanner virus

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/0a92ab70d1e5725ecabf5b90be95d2a4522b5080158818154e2d6dc978bc7e65

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1627418

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Yara detected Costura Assembly Loader

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0a92ab70d1e5725ecabf5b90be95d2a4522b5080158818154e2d6dc978bc7e65

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0a92ab70d1e5725ecabf5b90be95d2a4522b5080158818154e2d6dc978bc7e65/

ReversingLabs TitaniumCloud Script-PowerShell.Packed.Generic

Threat name:

Script-PowerShell.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-02-03 12:15:49 UTC

File Type:

Text

AV detection:

10 of 38 (26.32%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bkjkw4gr4vzf5sv7loil5fosurjcwueacwebqfkofvw4s6f4pzsq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/250302-lfdens1pw7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Suspicious use of NtCreateUserProcessOtherParentProcess

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0a92ab70d1e5725ecabf5b90be95d2a4522b5080158818154e2d6dc978bc7e65