MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f
SHA3-384 hash: f7f80630c0a5d69185afdb0d6419276647c59f3b93ccb1a66492a09ad68c39101e31c41e9a1a43fadec63685cf62a330
SHA1 hash: 6d2cb4e06b253adaba744697b9f645d49a5a752a
MD5 hash: 4f897c04acaaf3eaf7c5b9702c53573d
humanhash: timing-orange-fruit-jersey
File name:Host9271.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:761'848 bytes
First seen:2026-01-02 12:24:23 UTC
Last seen:2026-01-15 16:19:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:ZAf0oeqwK5TJfrTR0W+OMJL0opIFpwA/ursu/S+D:ZAf0k5TpCW+OML08IR/ursuN
TLSH T159F42A2157B9CDE0E4630B7EEB6CC622ADE42D57C6E1902D31B53926AF7081E472CB17
TrID 30.2% (.EXE) Win64 Executable (generic) (10522/11/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4504/4/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter ThreatOpsX
Tags:exe LummaStealer signed

Code Signing Certificate

Organisation:AstralInnovexTechGrid
Issuer:AstralInnovexTechGrid
Algorithm:sha256WithRSAEncryption
Valid from:2025-12-21T18:54:36Z
Valid to:2027-12-22T18:54:36Z
Serial number: bc661993b6cb65a6
Thumbprint Algorithm:SHA256
Thumbprint: 73ad1b91e6f270274dc0fa6333d88f2974fcabbaf02f39bc403173d4ccb12b82
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
http://marketing.bebe9mayotte.com
Verdict:
Malicious activity
Analysis date:
2025-12-30 16:10:23 UTC
Tags:
loader lumma stealer fingerprinting stealc upx
Link:
https://app.any.run/tasks/51e9c6d5-02cf-4b56-9292-120011c81572

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46884/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6957b933d2357cccc3de8f85
Tags:
injection phishing stealer virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt lumma packed signed stealer zero
Link:
https://www.filescan.io/uploads/6957b931127d6a14e0cc7fcf/reports/9e39dad6-034c-4df0-9a30-648bfd601798/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-24T12:53:00Z UTC
Last seen:
2026-01-03T14:18:00Z UTC
Hits:
~100
Detections:
BSS:Trojan.Win32.Generic Trojan-PSW.Win32.Lumma.zgg Trojan-PSW.Win32.Lumma.sb
Link:
https://opentip.kaspersky.com/691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f/results?tab=lookup
Malware family:
AtlasAgent
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d565cf5e-5909-4acf-a21e-c64b57212275
Score:
77%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/4f897c04acaaf3eaf7c5b9702c53573d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f
Threat name:
Win32.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-12-24 19:38:31 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=neizhwk7cdmuikc54vnt3rumdgmqkhappkjw6wdcwcg2v2rqdfpq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
error
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery spyware stealer
Link:
https://tria.ge/reports/260106-k7zxbaep51/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://pitifed.cyou/api
https://bendavo.su/asdsa
https://conxmsw.su/vcsf
https://narroxp.su/rewd
https://squeaue.su/qwe
https://ozonelf.su/asd
https://exposqw.su/casc
https://squatje.su/asdasd
https://vicareu.su/bcdf
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6d56cc11-5708-4375-94fc-98e48fa270ec
Unpacked files
SH256 hash:
691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f
MD5 hash:
4f897c04acaaf3eaf7c5b9702c53573d
SHA1 hash:
6d2cb4e06b253adaba744697b9f645d49a5a752a
Link:
https://www.unpac.me/results/81580116-0d50-4f24-aa44-1f732b6643c8/
SH256 hash:
f6312143f66ab179a5618e692f1ce856fbf98eb560a722ad86306c3071767f9f
MD5 hash:
84573180e1d9f55478de00044f2b5ada
SHA1 hash:
a5f02bda1be90abb3d2af70f7dd6c48ad180ae06
Detections:
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/81580116-0d50-4f24-aa44-1f732b6643c8/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/691193d95f10/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Lumma
Create hunting rule
Author:kevoreilly
Description:Lumma Payload
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/971fed93-4d27-46a5-9608-3aeb4afeb290
  
Dropping
LummaStealer
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/46884/

Comments