MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d691bd9d246d3d10f09b9a744250ca5b9602a5575b74bbae201eb6ed6df5c42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 6

Intelligence 6 IOCs YARA 8 File information Comments

SHA256 hash:	1d691bd9d246d3d10f09b9a744250ca5b9602a5575b74bbae201eb6ed6df5c42
SHA3-384 hash:	c49663d147c0450c3cf41e31a9b5c74466956990e282f270162f8d362c86a2c8d3b97d494f99e682358f4eb67e110977
SHA1 hash:	e3e3ee99f5b9f5938f0a3a2181f770ceb46ca679
MD5 hash:	b07dc4d61083e78db85b8a06aa789a24
humanhash:	cardinal-spaghetti-muppet-kilo
File name:	21363007443.zip
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'156'076 bytes
First seen:	2025-02-14 08:59:10 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: infected
ssdeep	24576:r8wjlAgDjNR4WPLMSHi2z9xfA1Z6dHHLm:r8wjljDjsWjMSa1Z+HH6
TLSH	T15235337326D93ADCEC1A446673D7AF71EA10A604D374C780D32C6F2AA0465AF465AF0B
Magika	zip
Reporter	salmanvs
Tags:	lumma zip

salmanvs

9b2df508ac48f1f43f2c36e8954c6552
lumma c2

Intelligence

File Origin

# of uploads :

# of downloads :

643

Origin country :

File Archive Information

This file is a password protected archive. The password is: infected

This file archive contains 1 file(s), sorted by their relevance:

File name:	ac52dc2ae20931a9117b10a357331b88ac7533b2f1531b845019e5ccf0e18cde
File size:	2'377'664 bytes
SHA256 hash:	ac52dc2ae20931a9117b10a357331b88ac7533b2f1531b845019e5ccf0e18cde
MD5 hash:	9b2df508ac48f1f43f2c36e8954c6552
MIME type:	application/x-dosexec
Signature	LummaStealer

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67af061fa0fd713c335acafe

Tags:

injection stealer virus

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/1d691bd9d246d3d10f09b9a744250ca5b9602a5575b74bbae201eb6ed6df5c42/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed signed

Link:

https://www.filescan.io/uploads/67af061e991985e0a958d378/reports/23af9e15-4106-4601-b176-bfc2d4997445/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1d691bd9d246d3d10f09b9a744250ca5b9602a5575b74bbae201eb6ed6df5c42

Score:

90%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/250214-pnet9awlam/

Behaviour

Suspicious behavior: EnumeratesProcesses

Browser Information Discovery

Reads user/profile data of web browsers

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Downloads MZ/PE file

Reads user/profile data of local email clients

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lumma

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1d691bd9d246d3d10f09b9a744250ca5b9602a5575b74bbae201eb6ed6df5c42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lumma Create hunting rule
Author:	kevoreilly
Description:	Lumma Payload

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)