MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 18


Intelligence 18 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af
SHA3-384 hash: 8e65fd185b8e450080285fe36507729b3c4ecc1854e2393560cd0acb43b68bae4ef51ad7b68249000047cb1b345f92d1
SHA1 hash: 29daaaaf58a263d6e2284cc6e08aaeb3748996ad
MD5 hash: 674b2b95cf07fcf84004723e069ec827
humanhash: rugby-king-minnesota-early
File name:54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af.bin
Download: download sample
Signature LummaStealer
Create hunting rule
File size:486'400 bytes
First seen:2026-03-08 11:18:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f6f05543bfd8242a24ed7d1738a5cdb5 (5 x LummaStealer, 1 x Amadey)
ssdeep 12288:ssAA+RVy+MBlSPyJVuoBa8YyANOV5qp1/0i:s7Auy/Bl6gVJa8fJV5Ax
TLSH T13FA4BF11B9D2C0F2D823253101E5E7769E3CB931C9718DCBFBD41D78AA3A390A75A25E
TrID 38.2% (.EXE) Win64 Executable (generic) (6522/11/2)
26.4% (.EXE) Win32 Executable (generic) (4504/4/1)
11.8% (.EXE) OS/2 Executable (generic) (2029/13)
11.7% (.EXE) Generic Win/DOS Executable (2002/3)
11.7% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter threatcat_ch
Tags:exe LummaStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://curtainjors.fun/api https://threatfox.abuse.ch/ioc/1761390/

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
Lumma
Details
Lumma
a c2 url or addresses, a missionid, and possibly a version and useragent
Link:
https://research.acce.ciphertechsolutions.com/results/f9b49fd3-8bdf-4245-a8f9-f0c1d7877dbc/
Malware family:
n/a
ID:
1
File name:
54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af.bin
Verdict:
No threats detected
Analysis date:
2026-03-08 11:20:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8a8a345f-6dfe-4f4b-ad97-e0e7b54e331e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lumma
Create hunting rule
Link:
https://www.capesandbox.com/analysis/56641/
Detection(s):
Win.Malware.Lumma-10013228-0
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ad5b00e5dc8e2b2c30f610
Tags:
small hype sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto lumma lumma masquerade microsoft_visual_cc stealer
Link:
https://www.filescan.io/uploads/69ad5af7cd25bfe1dfe46759/reports/25fdc2fa-5e25-4c6e-8941-75f588288037/overview
Verdict:
Malicious
Labled as:
Jaik.Generic
Link:
https://www.hybrid-analysis.com/sample/54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af
Verdict:
Malicious
File Type:
exe x32
Link:
https://opentip.kaspersky.com/54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af/results?tab=lookup
Malware family:
LummaC2 Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/38a6e681-32cc-4b61-8569-46c9d79acf93
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1880186
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found API chain indicative of sandbox detection
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af
Verdict:
Lumma Stealer
YARA:
5 match(es)
Tags:
Executable Lumma Stealer PE (Portable Executable) PE File Layout Stealer Win 32 Exe x86
Link:
https://app.malva.re/file/674b2b95cf07fcf84004723e069ec827
Detection:
lumma
Create hunting rule
Link:
https://mwdb.cert.pl/sample/54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2026-03-08 11:19:17 UTC
File Type:
PE (Exe)
AV detection:
24 of 24 (100.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktxog6f4fzcuxpyxjtz3splws6le2dvgrdloeraws63m2oriogxq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
error
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/260308-neebpags6v/
Behaviour
Program crash
System Location Discovery: System Language Discovery
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
http://curtainjors.fun/api
Unpacked files
SH256 hash:
54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af
MD5 hash:
674b2b95cf07fcf84004723e069ec827
SHA1 hash:
29daaaaf58a263d6e2284cc6e08aaeb3748996ad
Detections:
win_lumma_auto
Create hunting rule
win_lumma_a0
Create hunting rule
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/7cb9479f-df47-4ad8-a27c-c8b6f82d2750/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:win_lumma_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lumma.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

LummaStealer

Executable exe 54eee378bc2e454bbf174cf3b93d7697964d0ea688d6e2441697b6cd3a2871af

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/56641/

Comments