MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d9beb40b14a956556ef97cfa2ac410ec8c7509d35dbd2d050effc8c092e6de9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0d9beb40b14a956556ef97cfa2ac410ec8c7509d35dbd2d050effc8c092e6de9
SHA3-384 hash:	a6999abaf40ed769703e5dc8182808013fb5280baa426dc603299b5f005994af99d17794c652c18800e44bb5e0f233ce
SHA1 hash:	cc8cb59d30d428c1ca135bb4f8a0561486ce5ade
MD5 hash:	f7112cbc3171fec9547eddaabef0bd68
humanhash:	early-nuts-cup-juliet
File name:	𝓢𝓔𝓣𝓤𝓟🔹.exe
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	99'614'770 bytes
First seen:	2025-08-11 19:58:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	32f3282581436269b3a75b6675fe3e08 (197 x LummaStealer, 122 x Rhadamanthys, 8 x CoinMiner)
ssdeep	24576:TniO/qdjRNHDY1GXdbANgzu5ayIJ5iuTdlN7fzx:b/q5YadbAGUayIHtzx
TLSH	T19E2892FED04C03529D9726A6E897241A5FDFCC313914727702EEAA459B871CC27AB732
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	3070e0c0c9f0760e (2 x LummaStealer)
Reporter	aachum
Tags:	AutoIT CypherIT exe LummaStealer

iamaachum

https://www.download-setup.com/ => https://mega.nz/file/uox3EBiT#4Uwk-Q4fWG7WpZvPeOxB4mX8iamxVlU02f2DBGWq5nw

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

967

Origin country :

ES

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

b3be2661-d018-4b7d-b168-74e8f59a7cab

Verdict:

Malicious activity

Analysis date:

2025-08-11 20:01:52 UTC

Tags:

lumma stealer autoit

Link:

https://app.any.run/tasks/b3be2661-d018-4b7d-b168-74e8f59a7cab

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689a4ba4fca70bd90e8e6bd5

Tags:

phishing autoit emotet nsis

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug blackhole installer microsoft_visual_cc overlay overlay packed

Link:

https://www.filescan.io/uploads/689a4b659ef4d2ff7cf6f016/reports/8fe3afb8-63ef-4675-9a34-0857b27a9ac3/overview

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1754904

Signature

C2 URLs / IPs found in malware configuration

Detected CypherIt Packer

Drops PE files with a suspicious file extension

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Search for Antivirus process

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/0d9beb40b14a956556ef97cfa2ac410ec8c7509d35dbd2d050effc8c092e6de9

CERT.PL MWDB

Gathering data

Neiki Family.LUMMA

Verdict:

Malicious

Threat:

Family.LUMMA

Link:

https://tip.neiki.dev/file/0d9beb40b14a956556ef97cfa2ac410ec8c7509d35dbd2d050effc8c092e6de9

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-08-11 20:28:43 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

15 of 38 (39.47%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bwn6wqfrjkkwkvxps7h2flcbb3emoue5gxn5fucq576iycjonxuq._file

Hatching Triage lumma

Result

Malware family:

lumma

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma discovery persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/250811-yp4pfa1nt2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates processes with tasklist

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://vaganetka.ru/opza/api
https://mastwin.in/qsaz/api
https://ordinarniyvrach.ru/xiur/api
https://yamakrug.ru/lzka/api
https://vishneviyjazz.ru/neco/api
https://yrokistorii.ru/uqya/api
https://stolewnica.ru/xjuf/api
https://visokiywkaf.ru/mmtn/api
https://kletkamozga.ru/iwyq/api

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/be788f78-a89e-48f5-b555-721b0c3c22ba

VMRay CypherIt

Malware family:

CypherIt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0d9beb40b14a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.