MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 570a9cf6b8e27be28ebe9d2fc2879c0673a83e2d80a0edad383f0ce6df34d81b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 5

Intelligence 5 IOCs YARA 15 File information Comments

SHA256 hash:	570a9cf6b8e27be28ebe9d2fc2879c0673a83e2d80a0edad383f0ce6df34d81b
SHA3-384 hash:	458a3e59cf76c781e4acd883c9e19d8a57c5a1b2b62cf0a8f53e98f0dbc59b7460a31dd6ca6dec8eba8ad8035688bc71
SHA1 hash:	1c35670dd7af9dd584b6ee4e3003d8fab4f17bcd
MD5 hash:	6e8fdce12fac9d7f307d97ed7299dc90
humanhash:	white-high-oscar-sierra
File name:	Set-up.zip
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	7'096'252 bytes
First seen:	2025-02-06 14:59:34 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	98304:nBmOGAEHEDVNuIZw01TRot5KDra8WRM14FxWzNdu0:nQnGnRotGra8WtFwJx
TLSH	T179668BA94217CCD30D4422E242EBCB3F6E12C72057FA8A45AF14D4BBDB79456F1FA189
Magika	zip
Reporter	aachum
Tags:	file-pumped LummaStealer rezipped zip

iamaachum

https://uznhmij5kr2307244.click/25462a2c5048ab9e8ea00bb18ec2cb85b5debefd/file-67a4bf7415163/?source=12&grp=17&file=&q=Wondershare-Filmora-14-3-2-11147-With-Crack--RePack- => https://mega.nz/file/HY9QEAjT#cgjRl5SeMi42jRJXb5xSAMf5SfrS_C__Mtn4sNWgZUI/utm/2ae8fb7b001ed

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Set-up.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	848'886'690 bytes
SHA256 hash:	27b40c5f67d39b84ef21e359a7b5e2f58db2661f1fc81864b65d3bc38a0c6e0a
MD5 hash:	082dc42b91b68e3f6db40586a1d2fb74
De-pumped file size:	3'883'008 bytes (Vs. original size of 848'886'690 bytes)
De-pumped SHA256 hash:	3f044b7231f23539bc308ea385da5d37c9cf1131565b1ed4caa4ee02cc9bbbee
De-pumped MD5 hash:	ff43af57b3b66f39cce237ad533719e2
MIME type:	application/x-dosexec
Signature	LummaStealer

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a4d0942dcee78dd819cf60

Tags:

n/a

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/570a9cf6b8e27be28ebe9d2fc2879c0673a83e2d80a0edad383f0ce6df34d81b/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Gathering data

Verdict:

Suspicious

Labled as:

HEUR/Pumpar.Generic

Link:

https://www.hybrid-analysis.com/sample/570a9cf6b8e27be28ebe9d2fc2879c0673a83e2d80a0edad383f0ce6df34d81b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/570a9cf6b8e27be28ebe9d2fc2879c0673a83e2d80a0edad383f0ce6df34d81b/

Threat name:

Binary.Malware.Pumpar

Status:

Malicious

First seen:

2025-02-06 15:00:23 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

5 of 38 (13.16%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k4fjz5vy4j56fdv6tux4fb44azz2qprnqcqo3ljyh4gonxzu3anq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250206-sfqhkayjev/

Behaviour

Suspicious behavior: EnumeratesProcesses

Program crash

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	Lumma Create hunting rule
Author:	kevoreilly
Description:	Lumma Payload

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Suspicious_Latam_MSI_and_ZIP_Files Create hunting rule
Author:	eremit4, P4nd3m1cb0y
Description:	Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	weird_zip_high_compression_ratio Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects single-entry ZIP files with a suspiciously high compression ratio (>100:1) and decompressed size above the 500MB AV limit
Reference:	https://twitter.com/Cryptolaemus1/status/1633099154623803394