MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe
SHA3-384 hash: b7101baa047ab05b2b5f9c2c577da22d6b37239d99f5080315862349977f47b873d072f25900a527eb1d22991a2ab653
SHA1 hash: 58772b707e024b7a0cd31f6e5d5f3ab3815ef02a
MD5 hash: 25dfe566f0f1a65a104b3f50e10361b5
humanhash: sad-mexico-mirror-triple
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'027'520 bytes
First seen:2025-09-03 04:01:57 UTC
Last seen:2025-09-05 04:04:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:GMT+xuzugOGS4BFmN0/51SOLMdcVJgmQLIAqi9M9q:pTwGD8q6S55fi9Mc
Threatray 684 similar samples on MalwareBazaar
TLSH T1039501D97CB90AE0C61CC8B6847542E6E51D33797EB1B73F687FE089125ACB36721029
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:exe LummaStealer


Avatar
Bitsight
url: http://178.16.55.189/files/rdx/random.exe

Intelligence

File Origin
# of uploads :
15
# of downloads :
94
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
b49f3d39e97857f84a6bb13b8fe1742767e6054fd72b8fda5aa5ab34334534ee.bin.exe
Verdict:
Malicious activity
Analysis date:
2025-09-02 23:59:03 UTC
Tags:
lumma stealer themida amadey botnet loader auto redline rdp auto-reg golang stealc valleyrat winos rat silverfox vidar telegram autoit
Link:
https://app.any.run/tasks/aca4586d-ca2e-4a86-bedd-10cd5f2f8314

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lumma
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24830/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.89561941.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b7bde6eb163e0ec1843687
Tags:
phishing stealer virus crypt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68b7be41d5fe4d855590f818/reports/bb1b0b2c-c039-4c4c-bdb8-1b1b1a6171fc/overview
Verdict:
Malicious
Labled as:
Symmi.Generic
Link:
https://www.hybrid-analysis.com/sample/13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-02T16:06:00Z UTC
Last seen:
2025-09-02T16:06:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/57d5ab73-e281-4d59-abc6-33823cdc341e
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/25dfe566f0f1a65a104b3f50e10361b5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2025-09-03 01:33:01 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cpzaqkngfnelwfljos2w4xl5pm47mzqn3puxc24xxkokyq2wc77a._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
102c57004decd2173d86522467863123425f1ecccf37561fa34fca5c1de1c402
LummaStealer
2fd3d4a53dba424e61cab4f1f7b2f6d02079e0d0f06ed91dcc9f5214b1ee174a
LummaStealer
31ee08e0aad9297988beb54957c0fa5bce2d9b1d0d2c16e4932e247c73c19348
LummaStealer
49784cd5f974b8266ed02105bc6be8d04b7c7f798726caf15e052ba83a2b4c40
LummaStealer
6b023387ea48536d7900b1caff4c3568eb8761b55e0559b5680258bf28c55eec
LummaStealer
8cd2c50d76ca6672c8f99a66343af62f3a41c35a141f478f55044198ba8147c9
LummaStealer
a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7
LummaStealer
cb1ee7fa3edcc9795877868ad56cf32b9d6c3d95ea59d348e55c2b5caf87a180
LummaStealer
cdb8d74735fd803936cbb3f259418fa76aa5fa7ad03f8cba3b7d310006052e61
LummaStealer
e9b303f24082eaf87853558d2d427ad2eecc78acd538d37e1f4397d378b47c27
LummaStealer
error
LummaStealer
+ 674 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma defense_evasion discovery spyware stealer
Link:
https://tria.ge/reports/250903-em1efsen3w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Modifies trusted root certificate store through registry
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks BIOS information in registry
Identifies Wine through registry keys
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://eigwos.ru/wqex
https://mastwin.in/qsaz
https://noggs.ru/yopd
https://georgej.ru/plnb
https://oneflof.ru/tids
https://epitherd.ru/zadw
https://backab.ru/lkdo
https://kimmenkiz.ru/zldw
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6a3305bf-7345-4f2a-9a63-1b9dd655fb21
Unpacked files
SH256 hash:
13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe
MD5 hash:
25dfe566f0f1a65a104b3f50e10361b5
SHA1 hash:
58772b707e024b7a0cd31f6e5d5f3ab3815ef02a
Link:
https://www.unpac.me/results/9ee4d3f6-d5e7-450b-8f0d-c62f4a892f6e/
SH256 hash:
07ab2e62a0db6fd3683c934fc7b39b9b1ef473d66a1f674080a823948cf9a07b
MD5 hash:
260629041914c9522ac8bd9e89927d67
SHA1 hash:
5891b6fc4e4809757a1099e31ef58bb13573637e
Link:
https://www.unpac.me/results/9ee4d3f6-d5e7-450b-8f0d-c62f4a892f6e/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/13f20829a62b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Lumma
Create hunting rule
Author:kevoreilly
Description:Lumma Payload
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3615933/
Cape
Cape
https://www.capesandbox.com/analysis/24830/

Comments