MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b
SHA3-384 hash: d6df0a216cf509334676129ed3fa2c03bf9b123f87a2299d162d33543b00aaffe750e96741d89381524e4927e45b794c
SHA1 hash: e01d4ce7ae6ebfb25c72ecb6ee76cbddffe4867e
MD5 hash: 9cb38bc97e4b51b235349070b3cb6717
humanhash: bluebird-gee-mockingbird-whiskey
File name:SecuriteInfo.com.Win32.MalOb-FE.41123621
Download: download sample
Signature LummaStealer
Create hunting rule
File size:616'960 bytes
First seen:2025-09-13 20:44:07 UTC
Last seen:2025-09-14 04:03:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 536592d1313edded516434422df9d55e (1 x LummaStealer)
ssdeep 12288:aaSdtCL5jZ48mKRConMlDP4lQnT8+jGjW:9NjZ4DKRCf6lQno+q
TLSH T12ED46A0167E95045F6F37AB56FBAD5708B3ABC6A6831C25E21E03D4F34BCA439960336
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
6
# of downloads :
123
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
0_c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45.exe
Verdict:
Malicious activity
Analysis date:
2025-09-13 17:12:06 UTC
Tags:
auto redline stealer amadey botnet lumma loader rdp telegram themida coinminer miner stealc vidar gcleaner anti-evasion purecrypter
Link:
https://app.any.run/tasks/f5d2fff3-0a40-493d-a832-0f921a1f5fad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27365/
Detection(s):
SecuriteInfo.com.Win32.MalOb-FE.41123621.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c5d7bae579c633a4b5094f
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
microsoft_visual_cc obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68c5d7ec0d1238ff0aab72cd/reports/d27871ac-5866-4983-a7d0-9265c32e016c/overview
Verdict:
Malicious
Labled as:
Fragtor.Generic
Link:
https://www.hybrid-analysis.com/sample/69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-13T11:20:00Z UTC
Last seen:
2025-09-13T11:20:00Z UTC
Hits:
~100
Detections:
VHO:Backdoor.Win32.DarkKomet.gen HEUR:Trojan.Win32.Generic not-a-virus:HEUR:NetTool.Win32.Generic
Link:
https://opentip.kaspersky.com/69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/01c1e744-d3da-4dc6-be2e-831600753b0e
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/9cb38bc97e4b51b235349070b3cb6717
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-09-13 14:16:49 UTC
File Type:
PE (Exe)
Extracted files:
44
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nhznsu3dlbkgpkoywrvokpi7hlprjb2lwufjlpphlngkqbevmfnq._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
error
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery spyware stealer
Link:
https://tria.ge/reports/250913-zjyfxaytey/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Checks installed software on the system
Reads user/profile data of local email clients
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://jocospt.shop/gjai
https://lexenorf.org/zdhs
https://sirhirssg.su/xzde
https://prebwle.su/xazd
https://rhussois.su/tatr
https://todoexy.su/xqts
https://acrislegt.su/tazd
https://averiryvx.su/zadr
https://cerasatvf.su/qtpd
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2db18ff8-ecd1-41dd-b679-fb293ce92e93
Unpacked files
SH256 hash:
69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b
MD5 hash:
9cb38bc97e4b51b235349070b3cb6717
SHA1 hash:
e01d4ce7ae6ebfb25c72ecb6ee76cbddffe4867e
Link:
https://www.unpac.me/results/a53498f9-e5b4-40ff-a8d2-3e94c1b69c2a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 69f2d95363585467a9d8b46ae53d1f3adf14874bb50a95bde75b4ca80495615b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3623373/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/27365/

Comments