MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd
SHA3-384 hash: c6f865abee541c9476b50e01f1c38d30412407ba37134a3d1266b0012bdf340538b6bbfe544a9a8d1a34b8ef015858a9
SHA1 hash: 2ccffa21bbfd080840b423476534da32e68fcf96
MD5 hash: 6a7b3195cbc4f86382ace57ae1b69ebe
humanhash: king-edward-florida-wisconsin
File name:main8.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'652'160 bytes
First seen:2025-09-18 22:20:18 UTC
Last seen:2025-09-19 00:35:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d3b8060c77e25bad949642210b0e3d82 (2 x LummaStealer, 1 x Stealc)
ssdeep 49152:OkjfR5nJjR0AqEJrCPYsCFGZQ3xddxvWCmB2ne5HGtScX+YI9sROWCUSihhRJQJl:OkjfR5nJjR0AqEJrCPYsCFGZQ3xddxvQ
Threatray 62 similar samples on MalwareBazaar
TLSH T1E8C5AF25FC36918AECE34071BF39D211E5322D37DF28266B90DC4D900565DEEBA2E17A
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter tcains1
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
194
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
2to1ep.bin
Verdict:
Malicious activity
Analysis date:
2025-09-17 08:36:43 UTC
Tags:
auto metasploit framework python github smb amadey botnet stealer xenorat rat miner anti-evasion remote gh0st lumma njrat bladabindi backdoor meterpreter payload agenttesla quasar tinynuke generic cobaltstrike tool xworm loader stealc possible-phishing purelogs koadic a310logger redline pyinstaller clickfix pastebin phishing bruteratel xred networm amus discord formbook diamotrix clipper rhadamanthys asyncrat koiloader evasion remcos donutloader whitesnakestealer stormkitty vidar coinminer aurotun stealerium ransomware cryptolocker arechclient2 screenconnect rmm-tool rdp dcrat gcleaner hijackloader auto-sch-xml pdqconnect braodo telegram reverseloader arch-exec wannacry koistealer koi pythonstealer ultravnc darkroad websocket anydesk ftp exfiltration nanocore xor-url api-base64 susp-powershell crypto-regex delphi ims-api wmi-base64 frp
Link:
https://app.any.run/tasks/fc879bd5-e0bb-468c-ac9a-414d1f19028e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lumma
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28219/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cc85d76b621794b130bec2
Tags:
kryptik virus
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/68cc85d3f224aeb809c8a512/reports/dd8500b3-0044-422a-a800-fc9b5d076c31/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-18T19:10:00Z UTC
Last seen:
2025-09-18T19:10:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1e2d8ff5-d161-4b56-a612-9de8d2f551ad
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/6a7b3195cbc4f86382ace57ae1b69ebe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd/
Threat name:
Win64.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2025-09-18 22:21:03 UTC
File Type:
PE+ (Exe)
AV detection:
29 of 38 (76.32%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l3254sxmgcwtzdxxua73pgpecy5ynqp4l6qqom4chvjuhoaoftgq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
0d95e636a7e133f2d04f8cdcc0e7e46628a3172f6f5e8e3f2ceea014c911fd4c
LummaStealer
0d9b2c3014ecd8c4efcb87764ff24c84f41e4dcfed3853e9e2bb1d20f94f3bee
LummaStealer
1292a873d77a29f7c17698102795dbea54fa389460e151250877f4b487290466
LummaStealer
46ceaed5748b85d0f4941586d9478a6524882fd86a7892e1c3196d590699758a
LummaStealer
569f22213586ed9e170aa3640be123a4b9435679ddfea5eebb5cd427a25c29e7
LummaStealer
5e7f879e41daf4d06a1a3c9fc0dae67033d49de8a7fe73074b43af7f46a622ba
LummaStealer
5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd
LummaStealer
707837ab12e3265c697210c168216999b7f82727119723d8d1006a4d46d3093a
LummaStealer
9b65b8935969a153fe8e5cf18ec799e868328bd2ba1f5c6cbc5abfe437fed851
LummaStealer
error
LummaStealer
+ 52 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery stealer
Link:
https://tria.ge/reports/250918-19kheagn8w/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://consnbx.su/sawo
https://diadtuky.su/texz
https://sirhirssg.su/xzde
https://prebwle.su/xazd
https://rhussois.su/tatr
https://todoexy.su/xqts
https://acrislegt.su/tazd
https://averiryvx.su/zadr
https://cerasatvf.su/qtpd
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/829e9cd0-6e5c-42ef-990f-fa089e5f24e9
Unpacked files
SH256 hash:
5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd
MD5 hash:
6a7b3195cbc4f86382ace57ae1b69ebe
SHA1 hash:
2ccffa21bbfd080840b423476534da32e68fcf96
Link:
https://www.unpac.me/results/fec0e2b6-1876-44e2-8129-8ed956290c78/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 5ef5de4aec30ad3c8ef7a03fb799e4163b86c1fc5fa10733823d5343b80e2ccd

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/28219/
  
URLhaus
https://urlhaus.abuse.ch/url/3626546/

Comments