MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8
SHA3-384 hash:	99ed666493ae00e784800373933a80bcdbda6bca0fa4feec127f9488c254a6ef4189c6638f35e12fd84c10145a7ac726
SHA1 hash:	ff1a2b33f197bea5875f40fad6d50a37c4e2528d
MD5 hash:	e820d8b4a084e28ff917225b4a51271e
humanhash:	nuts-blue-kilo-jersey
File name:	SecuriteInfo.com.Win64.MalwareX-gen.21297.16488
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'187'840 bytes
First seen:	2025-07-26 10:16:21 UTC
Last seen:	2025-07-28 13:35:33 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3b7c4a0ab465369610558059bc25b774 (16 x LummaStealer, 3 x DarkCloud, 2 x Rhadamanthys)
ssdeep	24576:+HKCpyFxMQJZnJHzOKORLGPY3QrBk6OKORLGPY3QrBk2:8KpwmY3QrTwmY3Qrn
Threatray	116 similar samples on MalwareBazaar
TLSH	T1114501A5E19252F6F16A447586025240F6367C938B39AFDF43E4E6350E13BE60F3E722
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

15D83F4750C5ECCD1C20AB18E8C45F1E.exe

Verdict:

Malicious activity

Analysis date:

2025-07-26 00:36:58 UTC

Tags:

amadey botnet stealer loader rdp arch-exec telegram stealc vidar auto generic pentagon anydesk rmm-tool auto-reg auto-startup delphi lumma

Link:

https://app.any.run/tasks/ef5c2973-d5ee-4b6a-afa8-d81a710fceae

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Lumma

Link:

https://www.capesandbox.com/analysis/16952/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.21297.16488.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6884ab020b4775fb21316785

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a window

DNS request

Behavior that indicates a threat

Connection attempt

Sending a custom TCP request

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/6884ab0a13488cfd44d957e9/reports/8dcc09fe-6c33-4463-8953-2f229d755969/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/b3767f70-6cbe-4d88-b117-89100a2ef5f6

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 64 Exe x64

Link:

https://app.malva.re/file/e820d8b4a084e28ff917225b4a51271e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8/

Verdict:

Malicious

Threat:

VHO:Trojan-PSW.Win32.DarkCloud

Link:

https://tip.neiki.dev/file/4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8

Threat name:

Win64.Spyware.Lummastealer

Status:

Malicious

First seen:

2025-07-24 18:42:44 UTC

File Type:

PE+ (Exe)

AV detection:

22 of 35 (62.86%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jl7e6daiz72gjkupljzvrixab3fhllbhchadhj533na4hrubatea._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

8768adcf3b14b78ec2c34fdf77ea9cf25f53bf8fe7ab374ac4c5246779b87b64

LummaStealer

bd8f110fe735407ee172169f4bf728e8499e0ee54a62315eac82d34ee3d81e24

LummaStealer

cd385e78225757bc6032c670edb25fca7fc51110454a8c0da3ae1c2b28bc2464

LummaStealer

error

LummaStealer

+ 106 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/250726-ma46waynz2/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://siltapl.fun/xiru
https://royaltbn.xyz/xaoi
https://columnez.shop/xlak
https://mixp.digital/amnt
https://woodenso.top/xaoi
https://foundrr.bet/zuqy
https://potosuz.fun/xiir
https://wagnvp.fun/akjf
https://nanoceus.run/agkr

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/29e1169a-024f-4d3b-99e7-d244de83b682

Unpacked files

SH256 hash:

4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8

MD5 hash:

e820d8b4a084e28ff917225b4a51271e

SHA1 hash:

ff1a2b33f197bea5875f40fad6d50a37c4e2528d

Link:

https://www.unpac.me/results/42e0e922-0999-49fd-87a7-9ca4c93ae553/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 4afe4f0c08cff464aa8f5a7358a2e00eca75ac2711c033a7bbdb41c3c68104c8

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3590297/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/16952/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW
WIN_USER_API	Performs GUI Actions	USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample