MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 5 File information Comments

SHA256 hash:	4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae
SHA3-384 hash:	d8ad309996d13da72d053f0d6f6c90ed28d6042d02c30edc9460162c998e1877d0e152b9601f0db445bc0fb29aefb2f7
SHA1 hash:	e16f3e567758db6e789b8153f620fc1e40d98f75
MD5 hash:	81f42a840ac4e41dfaa4721425211c69
humanhash:	two-seventeen-mango-lion
File name:	New_$ET-UP_v25.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'250'038 bytes
First seen:	2025-05-31 17:16:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bf95d1fc1d10de18b32654b123ad5e1f (327 x LummaStealer, 65 x Rhadamanthys, 25 x Vidar)
ssdeep	24576:M0aobD1cqKc5Io9fsY2/nFp5/nRGWZdMs29Q065F/f2MT8He0mq1eiTDnCTBC7Vk:M8usdnKnFp5fdMNR6fL8H5mqgiDqUV9W
TLSH	T1F0452353CD58CC23CC47C6B074E58C3A7EB5690128D4CBE79389C6537F99384AAAB2E5
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	31f0acb0b8d8c070 (1 x LummaStealer)
Reporter	aachum
Tags:	AutoIT CypherIT exe LummaStealer

iamaachum

https://plamtr.b-cdn.net/BeroMe.html => https://plamtr.b-cdn.net/%E2%87%9A%E2%87%94PC%E2%87%94S%E2%88%8AT%E2%88%AAp%E2%87%947676%E2%87%94%C6%A4assWOr%C4%90%E2%87%9B.rar

Intelligence

File Origin

# of uploads :

# of downloads :

408

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

New_$ET-UP_v25.exe

Verdict:

Malicious activity

Analysis date:

2025-05-31 17:19:22 UTC

Tags:

autoit telegram lumma stealer autoit-loader

Link:

https://app.any.run/tasks/4dca35e2-3fa1-4938-a24c-15b634a26891

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/6537/

Detection(s):

SecuriteInfo.com.PUA.Glary-1.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=683b3a22acf88f5815e9b9d0

Tags:

phishing autoit emotet nsis

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %temp% directory

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a file

Creating a process from a recently created file

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt to an infection source

Behavior that indicates a threat

Query of malicious DNS domain

Sending a TCP request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

blackhole installer invalid-signature microsoft_visual_cc overlay overlay packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/683b3968e336a33801e12109/reports/f0d3ebbd-5b14-4637-9c16-61a6e3df4640/overview

Verdict:

Malicious

Labled as:

Win/grayware_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/81482e39-4e89-49ef-83f9-d9e2cb752887

Result

Threat name:

LummaC Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1703006

Signature

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

94%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae/

Threat name:

Win32.Spyware.Lummastealer

Status:

Suspicious

First seen:

2025-05-31 17:16:24 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 38 (44.74%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jydplwv4pkmn3j3el4ui6ffnifnng6i42mtjidyigynkdocmuwxa._file

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/250531-vtaqdabr3z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Enumerates processes with tasklist

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://https://t.me/fgjfnghfjmfkhg/api
https://mibtsm.run/gejz/api
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://harumseeiw.top/tqmn
https://diecam.top/laur/api
https://citellcagt.top/gjtu
https://thundeqqbw.bet/aznd

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/6a232964-395c-40c4-b6a7-faba468124ef

Unpacked files

SH256 hash:

4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae

MD5 hash:

81f42a840ac4e41dfaa4721425211c69

SHA1 hash:

e16f3e567758db6e789b8153f620fc1e40d98f75

Link:

https://www.unpac.me/results/5a0535c3-e453-435e-9a12-97b200ea63d5/

SH256 hash:

deb4c4e83e1adb2260878aa31059f751f48e2e433142a199b616128efba1ad0d

MD5 hash:

8b1414937e70e3ad5cfacc424dc701ac

SHA1 hash:

930bd7d902ec5093aa3639f8f6064592f744f59e

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/5a0535c3-e453-435e-9a12-97b200ea63d5/

Parent samples :

b57d78d93f74f7ae840ab03d3fda4f22a24ad35afcf9a53128cf82a92a67a085
06fc3e8f951fa3855d4056ea043a8de4d24b78df32f4423402305aa516fd56ff
659f55fe8c0a69b0f6c6440a777b409af34a8206613f7ed31b2b26cd821da339
fe4289d0e93af2b2bd4103c208c7887dfa2e776bc128ba00c8f5626dd386d689
5df0fcaba956997a24d19d6a56e95fb66f63e557627f461105e73e2baeae8e01
a6f505950424c626a2e800ee4d5b50de2e091d6b1f4f8ceeedc0e2e4af6aa6c0
d28fb0737213a89d3afc456a8735eeea48209d4d5ef31f8ec71a2c1796c660a3
befd287cf0e7ea186b496d2db1351ae25d279fa362babe0e0c0a00cb03287111
27a6c8ff6577be009fc1ad64de7c0856cb65407ee79b7fe1a48db58d3fccbc07
a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e
87b22dc6e19d8ae5d0a41560d6db0b3d7ae69a6e6a147fb5114b30ddf7710ace
f4d96aca90e5218b27a7d4a539d8ff5a16a6c4b94900bf1044c39254d51174fb
4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae
ec7755e923c5d31f0d3cd051a8d5fb52e4789d3a96ccd05210d38dea87221824
7ea240b6e590bb8cf4319ddc27b2ac6491ce0802b0cbb07e58bbad99f72e28d3
e285e972bd8877e3a8a5ac1cf4c7034c80c64866310e67131ab76655bbb69ee6
9137185e8f72c20aa75a54554a30ba0f8ab15696e57d4abad6d566df83dd9e89
9eefea2c305ae67db405c3fc3edb461259a9c0ec78b6cf156d084cd5b8eefc71
1f9869d28c20e90e919a1b739f83e96eac0b6d35f0fcdea932150e5fabb5c011
c82c126a95e90e070dc919b5bd4962af4dfb340b8d6f6e83bda42d63bc94eadd
1229329f146db6c61927e88dd7cb1cf4479352bc500f0a44a36d53916d82ee75

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4e06f5dabc7a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	win_lumma_generic Create hunting rule
Author:	dubfib

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae

(this sample)

Link

https://tria.ge/250531-vmkl1abq4t/behavioral1

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/6537/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW KERNEL32.dll::OpenProcess KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDiskFreeSpaceW KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::GetWindowsDirectoryW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::OpenClipboard USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample