MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 355f8d6cc33aa0ad0327924506d3e8f4f2f125a89803aacc4c8c4f5282505535. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 37 File information Comments

SHA256 hash:	355f8d6cc33aa0ad0327924506d3e8f4f2f125a89803aacc4c8c4f5282505535
SHA3-384 hash:	7d9728ded9826b29717b6d8ea4b4c908ba889cf0ab7fb0bee6d193c456ea07f65fe7635dca27a40ba16610efc4a78eaf
SHA1 hash:	1896f73eae393b69b914e2d5b7efb48e97ccd691
MD5 hash:	80e2ea1d445e6a8b8fc53db3e6371e27
humanhash:	magazine-edward-kitten-kansas
File name:	setup.zip
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	55'016'505 bytes
First seen:	2025-02-09 16:57:36 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	786432:jpNZVx9x5uGRA5+Tw+7SIBB/FaA68/BvjnWE8Hrmcll4WLT4KzEb7JG4daIGjIi:BVxb5RK+Z7SI3QniRWXC+5olVhdaIG8i
TLSH	T1FFC7335A04F68FC0DA4E5B3D50BF9B492255EF6680E6439B4336D3353EFA3B1AAD4081
Magika	zip
Reporter	aachum
Tags:	file-pumped LummaStealer rezipped zip

iamaachum

https://jfdiw5za.com/ => https://www.mediafire.com/file/6rnnhemyp4ak84y/PC@#%E2%9D%A2%C7%B4%F0%9D%95%96%F0%9D%94%B1-%F0%9D%95%8A%F0%9D%95%96%F0%9D%95%A5%F0%9D%93%A4%F0%9D%95%A1-8877__%E2%84%99%C7%8E$$%F0%9D%95%A8%F0%9D%9F%98%C9%BE%F0%9D%94%BB.zip/file

Intelligence

File Origin

# of uploads :

# of downloads :

363

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	842'799'396 bytes
SHA256 hash:	ef7c655643481c360843b6c702ec976730d0610c0ed14f06407cf80bbfa1b2c8
MD5 hash:	fc127880e7afb41b304d19701f08f1ff
De-pumped file size:	23'349'248 bytes (Vs. original size of 842'799'396 bytes)
De-pumped SHA256 hash:	ecff1d35c07e7ccfe9edd2d5417f6d7766348ad20138fd967d9383a2eb1f383f
De-pumped MD5 hash:	395b70526b5dbb28ec66f9227e65b214
MIME type:	application/x-dosexec
Signature	LummaStealer

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a8e08ad010e522d1b83a30

Tags:

shellcode spawn remo

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/355f8d6cc33aa0ad0327924506d3e8f4f2f125a89803aacc4c8c4f5282505535

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/355f8d6cc33aa0ad0327924506d3e8f4f2f125a89803aacc4c8c4f5282505535

Score:

51%

Verdict:

Susipicious

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	GuLoader Create hunting rule

Rule name:	Lumma Create hunting rule
Author:	kevoreilly
Description:	Lumma Payload

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)