MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 654ef3d3358fce7ef7794491c00e0c124bea10db5a1e5307ca1c86fbde075d11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	654ef3d3358fce7ef7794491c00e0c124bea10db5a1e5307ca1c86fbde075d11
SHA3-384 hash:	af3ae368f8b491e680465422f6838275706db032f96cc380575e98634fcacb136a9f7a3ef91579d6153c7da3ea8d52da
SHA1 hash:	cdec19f35924ff78fac6f63124aef6595b1a4008
MD5 hash:	f5bbd2ce4e51ad676d22cf2d84409694
humanhash:	alabama-minnesota-lion-emma
File name:	setup.exe
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	94'371'862 bytes
First seen:	2025-09-06 17:35:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	32f3282581436269b3a75b6675fe3e08 (197 x LummaStealer, 122 x Rhadamanthys, 8 x CoinMiner)
ssdeep	49152:u2gD3YQgsjCD22F8oo4GhVzfe5BAxvBH1:u3YQgsjP2OAGf7AU
TLSH	T130281215CB9124772679262736B363F21134A9E633119F546AC8623C61C22BFCF61BEF
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	aachum
Tags:	AutoIT CypherIT exe LummaStealer

iamaachum

https://filesxs.icu/?file=SGRyNFMzrWKsmBpiPTlJf05LV2Zt7QeD&yWRS7g8p3cP1Y=03NHbhkC5u7wAI6nVi9WjvLteUGrDSQ4ZORm8oXcl2yBs1E => https://mega.nz/file/XthXxaAa#A2GlMMFuhOqbApmwgdhqeym1Z3gy7K9LmDxpmh_2r1I

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

100

Origin country :

ES

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

setup.exe

Verdict:

Malicious activity

Analysis date:

2025-09-06 17:37:46 UTC

Tags:

lumma stealer autoit

Link:

https://app.any.run/tasks/8b8e39fc-083a-4cff-8c24-3eb4cfeae6f2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68bc7121eb163e0ec185213b

Tags:

autoit emotet

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Searching for the window

Searching for the Windows task manager window

Running batch commands

Creating a process with a hidden window

Launching cmd.exe command interpreter

Launching a process

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a process from a recently created file

Sending a custom TCP request

DNS request

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug blackhole installer microsoft_visual_cc nsis overlay

Link:

https://www.filescan.io/uploads/68bc70fafe1969faa8a717f3/reports/1cd45dcc-900b-4db0-a734-af399b8a2a43/overview

Hybrid Analysis NSIS.Androm.Generic

Verdict:

Malicious

Labled as:

NSIS.Androm.Generic

Link:

https://www.hybrid-analysis.com/sample/654ef3d3358fce7ef7794491c00e0c124bea10db5a1e5307ca1c86fbde075d11

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-05T12:10:00Z UTC

Last seen:

2025-09-05T12:10:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/654ef3d3358fce7ef7794491c00e0c124bea10db5a1e5307ca1c86fbde075d11/results?tab=lookup

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1772389

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Detected CypherIt Packer

Drops PE files with a suspicious file extension

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

36%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/654ef3d3358fce7ef7794491c00e0c124bea10db5a1e5307ca1c86fbde075d11

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Malware.Heuristic

Threat name:

Win32.Malware.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-06 03:49:27 UTC

File Type:

PE (Exe)

Extracted files:

17

AV detection:

18 of 38 (47.37%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mvhphuzvr7hh553zisi4adqmcjf6ueg3lipfgb6kdsdpxxqhluiq._file

Threatray unc_loader_058 lummastealer

Verdict:

malicious

Label(s):

unc_loader_058

Alert

Create hunting rule

lummastealer

Alert

Create hunting rule

Similar samples:

error

LummaStealer

Hatching Triage lumma

Result

Malware family:

lumma

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/250906-v6gpfszygs/

Behaviour

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates processes with tasklist

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://iaed.link/ndbh
https://mastwin.in/qsaz
https://digitbasket.com/pqox
https://voando26.com/iwnn
https://pyscalp.com/iqop
https://lzh.fr/mnsn
https://streamin.style/iqzb
https://phoenix-brands.dev/qyzb

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a8cfa9f7-8a1a-4087-aaf2-60383070320c

VMRay CypherIt

Malware family:

CypherIt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/654ef3d3358f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.