MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments

SHA256 hash:	1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e
SHA3-384 hash:	2456b3d107558d8a0080fb165150faf4d012166d022b8284541c160c7b8fe79a9c65b5c6927ae560e97f204856fa9486
SHA1 hash:	9004f15089694dfaecb32096abdf33e63ba08722
MD5 hash:	99ef093212c596e80f8720c7d418f07c
humanhash:	nevada-fifteen-emma-wisconsin
File name:	file
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'937'952 bytes
First seen:	2026-02-07 19:12:49 UTC
Last seen:	2026-02-07 21:20:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9a1c9fa2e77f12f22dafcdcbaa4c9e45 (1 x LummaStealer)
ssdeep	49152:EbiRFd3lS/q4TCzAlUnKi/S6QMiDuRIrCAUHdYr:EbiRb3lS/bGzsAPS6QD/rCNY
TLSH	T19495BE10DABF7A52F1EA2171D0A431171C7FBE5C0AA4809F33547CA93E7F183696A7A1
TrID	30.2% (.EXE) Win64 Executable (generic) (10522/11/4) 18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 14.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.9% (.EXE) Win32 Executable (generic) (4504/4/1) 5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	f0ccb0d9c9b0ccf0 (1 x LummaStealer)
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 LummaStealer signed

Code Signing Certificate

Organisation:	QuantumLink&Premium
Issuer:	QuantumLink&Premium
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-02-06T19:09:25Z
Valid to:	2028-02-07T19:09:25Z
Serial number:	c0dfc78583d65af3
Thumbprint Algorithm:	SHA256
Thumbprint:	4910852505af0751f69e558e4424e2242293408ce1fc3acaa75834d3b21ba8c2
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Bitsight

url: http://130.12.180.43/files/8428202012/2ES6RO8.exe

Intelligence

File Origin

# of uploads :

# of downloads :

239

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-02-07 19:16:02 UTC

Tags:

lumma stealer

Link:

https://app.any.run/tasks/67518bac-b0ab-4ad3-8e5e-9d1bef894be1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/52634/

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69878ecbb1f983b8468464c4

Tags:

injection phishing obfusc crypt

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context anti-debug installer-heuristic keylogger packed signed stealer

Link:

https://www.filescan.io/uploads/69878ec9930564ff3c913b3b/reports/83cbc0de-461d-4f7e-b11c-35bcc66579b0/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-02-07T16:25:00Z UTC

Last seen:

2026-02-08T12:54:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Win32.Lumma.aayh Trojan-PSW.Win32.Lumma.sb

Link:

https://opentip.kaspersky.com/1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e/results?tab=lookup

Malware family:

AtlasAgent

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8cf8c03b-3cc3-43af-affa-360559ea37ef

Score:

73%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/99ef093212c596e80f8720c7d418f07c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e/

Verdict:

Malicious

Threat:

Family.LUMMA

Link:

https://tip.neiki.dev/file/1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-02-07 19:13:38 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dpwcwa4ujuw3c4qafqhjxvu3yu77spnfbqfnxpji5hqepbdohjha._file

Verdict:

malicious

Label(s):

lummastealer

Similar samples:

error

LummaStealer

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/260207-xw6lyaaw5e/

Behaviour

System Location Discovery: System Language Discovery

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://coverxyzer.su/vvvfdv
https://whitepepper.su/asds
https://hammernew.su/asdase
https://heavylussy.su/ccvfd
https://broguenko.su/asfase
https://homuncloud.su/ascasef
https://familyriwo.su/fssdaw
https://izzardtow.su/cascasc
https://basilicros.su/asdasq

Unpacked files

SH256 hash:

1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e

MD5 hash:

99ef093212c596e80f8720c7d418f07c

SHA1 hash:

9004f15089694dfaecb32096abdf33e63ba08722

Link:

https://www.unpac.me/results/26dbf5ed-8ba8-4127-b547-178a56113f7a/

SH256 hash:

20b8ec7e56694405561cd898ef2252bd0add1518e960100f160f161c7b4d9e0a

MD5 hash:

8fb9006c7fa560ff7d39b6f3cc81ade8

SHA1 hash:

ece7c9bc25b2af2c061c0141b6cded48f4f4fdae

Detections:

LummaStealer

Link:

https://www.unpac.me/results/26dbf5ed-8ba8-4127-b547-178a56113f7a/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1bec2b03944d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.17

Link:

https://yomi.yoroi.company/submissions/1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.