MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dd3265f01f34745f691b087ae1a91a29309892fb283ef4f3e0ef358c73aad8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 5 File information Comments

SHA256 hash:	6dd3265f01f34745f691b087ae1a91a29309892fb283ef4f3e0ef358c73aad8d
SHA3-384 hash:	3e6afa732592c0155a1f37299e3c7384acecdfac71ff1dd7868d2a66a07deda304606c3be340b7e5eee0f74ef7a3bc07
SHA1 hash:	9349e2a915035ac054125698ff51f809479ce85c
MD5 hash:	99c4599fa4ba0f97d388d87bc606e9ee
humanhash:	earth-sweet-pasta-fish
File name:	SecuriteInfo.com.Win64.MalwareX-gen.15275.26192
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	958'976 bytes
First seen:	2025-06-07 07:19:33 UTC
Last seen:	2025-06-07 08:27:01 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9c0ddfde31303e468faa8e482d3a6897 (17 x LummaStealer, 1 x SnakeKeylogger)
ssdeep	24576:deFOyibRzGhjfuYKV4NQF1x6g+NDoOZMR4XRvoVjW6spjTSQaMDl:dzbRzGhjg6g+NLM0GjW6stTNaM
Threatray	293 similar samples on MalwareBazaar
TLSH	T1BB15AE28969192D9FC3500B980B156A578727A33C32C3FFB82A4F3739E0B6C58F56759
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

477

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

random.exe

Verdict:

Malicious activity

Analysis date:

2025-06-06 03:11:18 UTC

Tags:

amadey botnet stealer loader lumma rdp auto-reg themida telegram golang netreactor pureminer gcleaner evasion autoit

Link:

https://app.any.run/tasks/61ca81db-ddf1-4901-898e-3b5d850b46ad

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/7870/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.15275.26192.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6843e9148bd5d68a12e631bf

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Connection attempt to an infection source

DNS request

Connection attempt

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/6dd3265f01f34745f691b087ae1a91a29309892fb283ef4f3e0ef358c73aad8d

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/3606d8db-547c-40dc-b6cb-07208db872b7

Result

Threat name:

LummaC Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1708717

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6dd3265f01f34745f691b087ae1a91a29309892fb283ef4f3e0ef358c73aad8d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6dd3265f01f34745f691b087ae1a91a29309892fb283ef4f3e0ef358c73aad8d/

Threat name:

Win64.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-06-05 21:32:22 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nxjsmxyb6ndul5urwcd24gurukjqtcjpwkb66tz6b3zvrrz2vwgq._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

4dfc09bfab1e813c8122d6f8c3d83966346fe676464497ce100e8c385fe5e5f9

LummaStealer

6dd3265f01f34745f691b087ae1a91a29309892fb283ef4f3e0ef358c73aad8d

LummaStealer

bbd85767b55c01fabf2f219a44e94e826d457b511da9fb636c15c739d11ae015

LummaStealer

c17b7261ae417564d88380a738091ed454fa994a26ae303d2715b86bb6a7d846

LummaStealer

e4b8bb93303b3732823c89b780cf28b7274881be6e67e566b4218d7bb1c39abd

LummaStealer

error

LummaStealer

+ 283 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/250607-h6ajxsyva1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://battlefled.top/gaoi
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://stochalyqp.xyz/alfp
https://diecam.top/laur/api
https://citellcagt.top/gjtu
https://peppinqikp.xyz/xaow

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/75ee5c51-0819-468e-9b02-c031d0b4ba8c

Unpacked files

SH256 hash:

6dd3265f01f34745f691b087ae1a91a29309892fb283ef4f3e0ef358c73aad8d

MD5 hash:

99c4599fa4ba0f97d388d87bc606e9ee

SHA1 hash:

9349e2a915035ac054125698ff51f809479ce85c

Link:

https://www.unpac.me/results/3f957088-61d9-4fb9-90ba-15fb485d68d6/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6dd3265f01f3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6dd3265f01f34745f691b087ae1a91a29309892fb283ef4f3e0ef358c73aad8d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)