MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21d9328f56233b026c0fa5ab3ed885e6c07f356fcbc32fe47c6125434929345c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 2

Intelligence 2 IOCs YARA 6 File information Comments

SHA256 hash:	21d9328f56233b026c0fa5ab3ed885e6c07f356fcbc32fe47c6125434929345c
SHA3-384 hash:	141d53d7b1f36324445e60edd7b26d4ecf3daddbdfeb83a39e3518c8e30c321c952b3b5a6c6cb80ab1d3b83d1b14bf89
SHA1 hash:	0a904851f74dbc8e4384958888c84bc5b1a442f9
MD5 hash:	48ccd17cc8cb7aa1c2d3f7537adffb40
humanhash:	arkansas-uranus-chicken-kitten
File name:	#Pa$$CŌ𝔻e--5957__OpeN-Setup@!#.7z
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	2'540'323 bytes
First seen:	2025-04-09 23:07:13 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 5957
ssdeep	49152:VlFn8pE360TyeHYnd4PQjnFkqV23rx88TF7xhHaoKIKBfuO:VlFn8PgjHYnvo18EraRZZuO
TLSH	T160C533F5A86FB2F8B191875F90E1526BCB15F164851EFD925830B380E01C15AEA3AF3D
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z file-pumped LummaStealer pw-5957

iamaachum

https://fine-download.click/?Lp1VD7hd58vinAWFGmgxQc2JU6ftNTuErY3XqOwI=L9kSU2vxs7Q0HRgaTrZ8V5MyuK6WOJINnY1C3Fblhej=1JiylvTLFHrxubpaDsoen70XCStKVO54YR2EPQmBjhfcgzN&h=131 => https://mega.nz/file/z5AmyJqL#ycKdr5HHjQAicDJabD2ZNvrJkxOrWvNDjTPWATDOB2Y

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

File Archive Information

This file is a password protected archive. The password is: 5957

This file archive contains 1 file(s), sorted by their relevance:

File name:	setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	721'116'580 bytes
SHA256 hash:	706ffd4300d219bcdd255996cd26e7ea70cd5106f5854ea9706ba0c55de26ec9
MD5 hash:	4c292616d420e0cba672f14ee8f6a280
De-pumped file size:	1'509'888 bytes (Vs. original size of 721'116'580 bytes)
De-pumped SHA256 hash:	4c9b4a0e138e719db7be942ab2b36b242b4857b03cbeb9dcc327e4e0a6f416a7
De-pumped MD5 hash:	1eaff6fd0df1af3e523b20d81a2b72c8
MIME type:	application/x-dosexec
Signature	LummaStealer

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f7048df9ba909217ce50c8

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/21d9328f56233b026c0fa5ab3ed885e6c07f356fcbc32fe47c6125434929345c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/21d9328f56233b026c0fa5ab3ed885e6c07f356fcbc32fe47c6125434929345c/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ehmtfd2wem5qe3apuwvt5wef43ah6nlpzpbs7zd4mesugsjjgroa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)