MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5
SHA3-384 hash: f7faafdbf350a127e9b7909a08ff4e2a8a516fe449f0162495d617f2926a33cb85e0b9fd0928800a106eb7cd06bcced5
SHA1 hash: cf4f14a4fa764500fb7f9a4717101d2c55ed77a6
MD5 hash: 3fef586415c1c48517c6f2f3ca7a9b8d
humanhash: kansas-crazy-fix-william
File name:random.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'887'744 bytes
First seen:2025-05-20 11:46:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:VeSVxf/L7m0OHZ3RcCbL12ErfQuc3xgfeAg8:ZVxHfm0QBcCn12GfQ3xHt
Threatray 1 similar samples on MalwareBazaar
TLSH T16B95330A7ECB265CF121C172DC5E0276F1ADBAA149740E89E157FDBB89E3F697700188
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
506
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-05-20 12:35:07 UTC
Tags:
lumma stealer themida
Link:
https://app.any.run/tasks/8fc1388e-5f2d-45ae-9191-db7bcf9ceb10

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682c6bcbc28c67d666424b2b
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Connection attempt to an infection source
DNS request
Connection attempt
Sending an HTTP GET request
Behavior that indicates a threat
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt packed packed packer_detected xpack
Link:
https://www.filescan.io/uploads/682c6bccc609634bd7cb4fcf/reports/5d288377-70df-4ca9-9666-73117340ce98/overview
Verdict:
Malicious
Labled as:
Symmi.Generic
Link:
https://www.hybrid-analysis.com/sample/17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a63ac9ec-6750-47d3-8d07-52c9e675f7c4
Result
Threat name:
Amadey, LummaC Stealer, PRYSMAX STEALER,
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1694894
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to start a terminal service
Detected unpacking (changes PE section rights)
Drops password protected ZIP file
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: PUA - NSudo Execution
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Uses cmd line tools excessively to alter registry or file data
Writes to foreign memory regions
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected LummaC Stealer
Yara detected PRYSMAX STEALER
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1694894 Sample: random.exe Startdate: 20/05/2025 Architecture: WINDOWS Score: 100 108 Found malware configuration 2->108 110 Malicious sample detected (through community Yara rule) 2->110 112 Antivirus detection for URL or domain 2->112 114 18 other signatures 2->114 13 random.exe 1 2->13         started        18 ramez.exe 2->18         started        process3 dnsIp4 94 40.91.108.115 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 13->94 96 185.156.72.2 ITDELUXE-ASRU Russian Federation 13->96 98 2 other IPs or domains 13->98 84 C:\Users\...\LE3AJOPD1OV9QI9F8EAEL80J1.exe, PE32 13->84 dropped 144 Detected unpacking (changes PE section rights) 13->144 146 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->146 148 Query firmware table information (likely to detect VMs) 13->148 156 8 other signatures 13->156 20 LE3AJOPD1OV9QI9F8EAEL80J1.exe 4 13->20         started        150 Contains functionality to start a terminal service 18->150 152 Hides threads from debuggers 18->152 154 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->154 file5 signatures6 process7 file8 66 C:\Users\user\AppData\Local\...\ramez.exe, PE32 20->66 dropped 126 Antivirus detection for dropped file 20->126 128 Detected unpacking (changes PE section rights) 20->128 130 Contains functionality to start a terminal service 20->130 132 6 other signatures 20->132 24 ramez.exe 4 36 20->24         started        signatures9 process10 dnsIp11 92 185.156.72.96 ITDELUXE-ASRU Russian Federation 24->92 68 C:\Users\user\AppData\Local\...\oxDU0MW.exe, PE32+ 24->68 dropped 70 C:\Users\user\AppData\Local\...\SPpr8Zz.exe, PE32+ 24->70 dropped 72 C:\Users\user\AppData\Local\...\08IyOOF.exe, PE32+ 24->72 dropped 74 10 other malicious files 24->74 dropped 134 Antivirus detection for dropped file 24->134 136 Detected unpacking (changes PE section rights) 24->136 138 Contains functionality to start a terminal service 24->138 140 6 other signatures 24->140 29 b124a506c4.exe 15 24->29         started        32 SPpr8Zz.exe 24->32         started        file12 signatures13 process14 file15 76 C:\Users\user\AppData\Local\...\nircmd.exe, PE32+ 29->76 dropped 78 C:\Users\user\AppData\Local\...\cecho.exe, PE32 29->78 dropped 80 C:\Users\user\AppData\Local\...80SudoLG.exe, PE32+ 29->80 dropped 82 2 other malicious files 29->82 dropped 35 cmd.exe 1 29->35         started        100 Writes to foreign memory regions 32->100 102 Allocates memory in foreign processes 32->102 104 Injects a PE file into a foreign processes 32->104 38 MSBuild.exe 32->38         started        41 conhost.exe 32->41         started        signatures16 process17 dnsIp18 116 Uses cmd line tools excessively to alter registry or file data 35->116 43 cmd.exe 1 35->43         started        46 conhost.exe 35->46         started        86 149.154.167.99 TELEGRAMRU United Kingdom 38->86 88 49.13.1.124 HETZNER-ASDE Germany 38->88 90 127.0.0.1 unknown unknown 38->90 118 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 38->118 120 Found many strings related to Crypto-Wallets (likely being stolen) 38->120 122 Tries to harvest and steal ftp login credentials 38->122 124 3 other signatures 38->124 signatures19 process20 signatures21 142 Uses cmd line tools excessively to alter registry or file data 43->142 48 Unlocker.exe 43->48         started        51 7z.exe 43->51         started        54 cmd.exe 43->54         started        56 31 other processes 43->56 process22 file23 106 Multi AV Scanner detection for dropped file 48->106 58 cmd.exe 48->58         started        64 C:\Users\user\AppData\Local\...\Unlocker.exe, PE32 51->64 dropped 60 tasklist.exe 54->60         started        signatures24 process25 process26 62 conhost.exe 58->62         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5/
Threat name:
Win32.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-05-20 11:47:20 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c66sahpsroxc7pprqyjcd6772dxwj6nxq7ge3c7saqusse34xhkq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5
LummaStealer
error
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:lumma botnet:8d33eb defense_evasion discovery spyware stealer trojan
Link:
https://tria.ge/reports/250520-nxzqcacj9y/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Amadey family
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://clarmodq.top/qoxo
https://zenithcorde.top/auid
https://techguidet.digital/apdo
https://6btcgeared.live/lbak
https://buzzarddf.live/ktnt
https://techsyncq.run/riid
https://parakehjet.run/kewk
https://wbearjk.live/benj
http://185.156.72.96
Unpacked files
SH256 hash:
17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5
MD5 hash:
3fef586415c1c48517c6f2f3ca7a9b8d
SHA1 hash:
cf4f14a4fa764500fb7f9a4717101d2c55ed77a6
Link:
https://www.unpac.me/results/56a4eacd-4822-41b2-b6a1-5b1436f7109f/
SH256 hash:
69e7576baf176d260c48200194ca6855746d87b4d083b623ef2d7cb9a43409f9
MD5 hash:
70754a9191209d7b859e710509deb11e
SHA1 hash:
d5f4cb63fffff9774bedcb19e0cc8c592c415f2a
Link:
https://www.unpac.me/results/56a4eacd-4822-41b2-b6a1-5b1436f7109f/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/17bd201df28b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 17bd201df28bae2fbdf1861221fbffd0ef64f9b787cc4d8bf2042929137cb9d5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3542096/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments