MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 4 File information Comments

SHA256 hash:	69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c
SHA3-384 hash:	333a802e08e268ccaf15803de341fe6ebc6f071734f8fd36d6b2d78cd1bba558a801eea26f2f7566fa0353c00dad069b
SHA1 hash:	2b60887b9d4e90559214790a6ee05955f6b88733
MD5 hash:	78c10f7e082ef95e2c446ad33f2bd8b8
humanhash:	venus-mississippi-equal-yankee
File name:	BB2[1].exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'980'928 bytes
First seen:	2025-08-09 01:04:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	75a20672afc7bfa2e72f3631474db75d (4 x LummaStealer, 2 x Stealc, 2 x Vidar)
ssdeep	49152:d62gkn0Vqu0URA5ie7Yqarmxs5Lf1vxmVTT:d6S0VMURGQmxs5LOF
Threatray	330 similar samples on MalwareBazaar
TLSH	T19A95C025E87890DAFDD301B177599252A4237F3BDE2C6A9B40F48B50124AEED163F13B
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	aachum
Tags:	dropped-by-gcleaner exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

c9742576_.exe

Verdict:

Malicious activity

Analysis date:

2025-08-08 23:23:42 UTC

Tags:

gcleaner loader lumma stealer auto redline amadey botnet telegram auto-reg rhadamanthys auto-startup stealc autoit themida rdp github vidar

Link:

https://app.any.run/tasks/041927b3-492e-4a65-977f-864da3870ca6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Lumma

Link:

https://www.capesandbox.com/analysis/19789/

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68969ea71e8a59ee04e7b70b

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

DNS request

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Creating a window

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed similar-threat

Link:

https://www.filescan.io/uploads/68969ea29ef4d2ff7cf37a01/reports/f2f6fba7-1346-402e-8e20-daffcf265427/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/4252aa8a-60f6-48b0-82d2-d7f6f0ef0dd7

Result

Threat name:

LummaC Stealer

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1753476

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 64 Exe x64

Link:

https://app.malva.re/file/78c10f7e082ef95e2c446ad33f2bd8b8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c/

Verdict:

Malicious

Threat:

Family.LUMMA

Link:

https://tip.neiki.dev/file/69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c

Threat name:

Win64.Spyware.Lummastealer

Status:

Suspicious

First seen:

2025-08-09 00:57:51 UTC

File Type:

PE+ (Exe)

AV detection:

20 of 24 (83.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nhzfb6g7rulz3wemtbp3hctukps26ynsntawuhrhbcq2g6bu4f6a._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

5e4107d5483ac76b7b8005103da339ad96b87a808d3eb2e7b7e97844b6a84453

LummaStealer

69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c

LummaStealer

afc25cfb131af91d7b7be577b5aae6af861edf377fbd4dd3faacd7fa42b88854

LummaStealer

b303e5fa63277691ab5249294772aed02d0f294fe2d69dc5dfe2cc77a15a4e7a

LummaStealer

d1fd59641f5508ad3b1743e8d850b0a341527cb9d688c586c931e2f130d84c75

LummaStealer

e439378ca0ca70865ce01d9e795927bd542ee929db1671509555c4fc82c3e65d

LummaStealer

error

LummaStealer

+ 320 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/250809-be85vafl2y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://t.me/yahherhay
https://mocadia.com/iuew
https://mastwin.in/qsaz/api
https://ordinarniyvrach.ru/xiur/api
https://yamakrug.ru/lzka/api
https://vishneviyjazz.ru/neco/api
https://yrokistorii.ru/uqya/api
https://stolewnica.ru/xjuf/api
https://visokiywkaf.ru/mmtn/api
https://kletkamozga.ru/iwyq/api

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9bb08b63-a4f2-4964-8a8f-818fba0cdf74

Unpacked files

SH256 hash:

69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c

MD5 hash:

78c10f7e082ef95e2c446ad33f2bd8b8

SHA1 hash:

2b60887b9d4e90559214790a6ee05955f6b88733

Link:

https://www.unpac.me/results/9214e19d-1ae0-49d5-9125-a07677db3037/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/69f250f8df8d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/69f250f8df8d179dd88c985fb38a7453e5af61b26cc16a1e2708a1a37834e17c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)