MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61
SHA3-384 hash: bf61f9f42173f0817793effe4a85951fd030196e07eb77f73c8eda61726a62570a27af7f53cdad479068411d6a3e50e1
SHA1 hash: a5cd128e2d4e1f93552817d34e6c81ad4d0cf2cf
MD5 hash: c8cf72fc26151079476144c5a11dc1bd
humanhash: hot-texas-nitrogen-october
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:887'808 bytes
First seen:2025-09-07 04:03:26 UTC
Last seen:2025-09-07 04:04:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b2c81b106d11ae81264a5fbcab0aae8b (11 x LummaStealer, 4 x Rhadamanthys, 1 x Stealc)
ssdeep 12288:7P5uVJjHWJGTRYeOME3EY+9tJuxsptYOGn/9DeqSYIhReuxAeCRVENmWc:7KKGdBLt4K659DeDYkxML
Threatray 284 similar samples on MalwareBazaar
TLSH T1A915E025A1A253FAE1A640B54A469501F833BC6387746FEF43E0D6762E17BE01F3E325
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe LummaStealer


Avatar
Bitsight
url: http://178.16.54.200/files/fate/random.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
116
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61.bin.exe
Verdict:
Malicious activity
Analysis date:
2025-09-06 17:39:28 UTC
Tags:
telegram lumma stealer
Link:
https://app.any.run/tasks/ab61dfc4-9f02-41a4-8dc2-b3327d53b6d7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/26083/
Detection(s):
Win.Packed.Lazy-10057857-0
Create hunting rule

Win.Packed.Lazy-10057858-0
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bd04383e988eb6ab8441fd
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context fingerprint microsoft_visual_cc obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68bd048c20d0ee406d988724/reports/1f9a1d52-ffb0-4207-9757-2d7fd13bb582/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-06T14:42:00Z UTC
Last seen:
2025-09-06T14:42:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Agent.sb Trojan-PSW.Win32.Lumma.sb VHO:Trojan.Win32.InjectorNetT.cgj BSS:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ae9ee9cd-df98-4ef0-93ad-0c04061c1d45
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/c8cf72fc26151079476144c5a11dc1bd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61
Threat name:
Win64.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-09-06 17:39:29 UTC
File Type:
PE+ (Exe)
AV detection:
30 of 38 (78.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lzxfc3cdxitiy37rxrg4dnttw2xfh4sblbt2msrvhxa4uwirrnqq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
412ca2418f93632714eda5e2bff8ac5dce16635803b805052d0353a0a9c3e28a
LummaStealer
41979cb6a17c15962a9c3e2835c70fda67182c3a5e2dc81f1b02412399256d63
LummaStealer
5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61
LummaStealer
6010fce772793e35168d6216a5127bcbbd68829b0d80ea7bb5e7289c0ddd0643
LummaStealer
61b0374c1c5cb8194b2bba4ca0d8b05417cbc442cfd82ab62e083b13d2ab15ce
LummaStealer
error
LummaStealer
fc8197adf50313fa8d889ded2ed96600a9d946caa01448d21b207bfe94ccff0e
LummaStealer
+ 274 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/250907-enr5gacj7t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://t.me/romalabs
https://marvelvod.com/uqia
https://dubznetwork.com/wqii
https://digitbasket.com/pqox
https://voando26.com/iwnn
https://iaed.link/ndbh
https://pyscalp.com/iqop
https://lzh.fr/mnsn
https://streamin.style/iqzb
https://phoenix-brands.dev/qyzb
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3853c13d-8844-4640-be1c-b699625c5fc3
Unpacked files
SH256 hash:
5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61
MD5 hash:
c8cf72fc26151079476144c5a11dc1bd
SHA1 hash:
a5cd128e2d4e1f93552817d34e6c81ad4d0cf2cf
Link:
https://www.unpac.me/results/3a4c301c-7ca5-4ef5-846e-6177eff84140/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5e6e516c43ba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3617790/
Cape
Cape
https://www.capesandbox.com/analysis/26083/

Comments