🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e02b8b25ba0337d9006b4859284eff6ebdd985f2a3b06ce4a72c69ed2f71892. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e02b8b25ba0337d9006b4859284eff6ebdd985f2a3b06ce4a72c69ed2f71892
SHA3-384 hash: 581f0fef0ee501c44c1247e6d6130dcb4eb41d20b5be3edb3b9cd34e9d8a48b0052c47d99514a72e5c92762f7d4ea346
SHA1 hash: c128119ce76ab4d848c73de982e709062a48c1ee
MD5 hash: 2cce923694413406d117c5ba44934f94
humanhash: stairway-oscar-cola-south
File name:𝙎𝙀𝙏𝙐𝙋.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:94'371'872 bytes
First seen:2025-07-26 19:48:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 32f3282581436269b3a75b6675fe3e08 (198 x LummaStealer, 123 x Rhadamanthys, 8 x CoinMiner)
ssdeep 24576:AFgst0d42LGyczBCmCoOHipL5pchdIUvWPcLZVG:Rd/LGyeBrJ5SnpGoG
TLSH T17728119E73FD76C91D9BC3613687D8AEF4A0B089B134095C2D72D5615A202B1C3F62EB
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 4d4b03d9f930b252 (2 x LummaStealer)
Reporter aachum
Tags:AutoIT CypherIT exe LummaStealer


Avatar
iamaachum
https://plcbvisa.com/?=ijn&diu=66&sid=VX6 => https://mega.nz/file/v9hUTICB#UBIaB5fvoVQ8S4gqMOgo0J5O0xKR_1orVY-hge-AbEU

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8e67a525-d2ba-4f9b-8a89-4719eee7d04f
Verdict:
Malicious activity
Analysis date:
2025-07-26 19:50:30 UTC
Tags:
autoit telegram lumma stealer
Link:
https://app.any.run/tasks/8e67a525-d2ba-4f9b-8a89-4719eee7d04f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688531b80b4775fb2131af78
Tags:
phishing autoit emotet
Result
Verdict:
Clean
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug blackhole installer microsoft_visual_cc overlay overlay
Link:
https://www.filescan.io/uploads/6885314aa16348d835efc116/reports/e3900270-e46d-4f34-a2dc-564bb3dedf3f/overview
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1744765
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Deletes itself after installation
Drops PE files with a suspicious file extension
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Search for Antivirus process
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1744765 Sample: #Ud835#Ude4e#Ud835#Ude40#Ud... Startdate: 26/07/2025 Architecture: WINDOWS Score: 100 31 t.me 2->31 33 rdGPqXcKmfjNeMlfcQBUONDXtzWMi.rdGPqXcKmfjNeMlfcQBUONDXtzWMi 2->33 35 prezud.top 2->35 47 Found malware configuration 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 5 other signatures 2->53 8 #Ud835#Ude4e#Ud835#Ude40#Ud835#Ude4f#Ud835#Ude50#Ud835#Ude4b.exe 26 2->8         started        signatures3 process4 file5 25 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->25 dropped 27 C:\Users\user\AppData\Local\Temp\Usage.flv, DOS 8->27 dropped 11 cmd.exe 4 8->11         started        process6 file7 29 C:\Users\user\AppData\Local\Temp\...\Inns.com, PE32 11->29 dropped 55 Uses ping.exe to sleep 11->55 57 Drops PE files with a suspicious file extension 11->57 59 Uses ping.exe to check the status of other devices and networks 11->59 15 Inns.com 11->15         started        19 extrac32.exe 18 11->19         started        21 conhost.exe 11->21         started        23 6 other processes 11->23 signatures8 process9 dnsIp10 37 t.me 149.154.167.99, 443, 49690 TELEGRAMRU United Kingdom 15->37 39 prezud.top 167.160.161.12, 443, 49691, 49692 ASN-QUADRANET-GLOBALUS United States 15->39 41 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->41 43 Query firmware table information (likely to detect VMs) 15->43 45 Deletes itself after installation 15->45 signatures11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6e02b8b25ba0337d9006b4859284eff6ebdd985f2a3b06ce4a72c69ed2f71892
Gathering data
Threat name:
Win32.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-07-26 20:30:43 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
15 of 37 (40.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nyblrms3uazx3eagwsczfbhp63v53gc7fi5qntskoldj5uxxdcja._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
error
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma defense_evasion discovery spyware stealer trojan
Link:
https://tria.ge/reports/250726-yjbfpsbr9w/
Behaviour
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Windows directory
Enumerates processes with tasklist
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://t.me/sadjv23jadjdhjsa
https://prezud.top/xkaj
https://molefkx.com/xalo
https://sponfht.com/xrie
https://runuxs.org/zpla
https://follcp.org/atnr
https://remotuw.org/xiza
https://boltex.net/xpao
https://detrewb.net/aqyw
https://berijng.net/otir
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/836d8d71-aed7-4725-9ad9-9e23268efe6b
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 6e02b8b25ba0337d9006b4859284eff6ebdd985f2a3b06ce4a72c69ed2f71892

(this sample)

  
Link
https://tria.ge/250726-x11w9aswfz/behavioral1
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetWindowsDirectoryW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments