🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e81d52980b66608b0610004e9e39e044322b93aaa3cf6a714de44f273c8ef50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e81d52980b66608b0610004e9e39e044322b93aaa3cf6a714de44f273c8ef50
SHA3-384 hash: 75f6419ce093d905dbfcee2ab2cd9d392b1d3cb909f6f3a3a891e2c8e3c96a57784879116246587e5adb875dd08b1108
SHA1 hash: 945ea40ec5e0e66fbe34528a9eb7ed038f0b2a7b
MD5 hash: ee05be9e7e7b7e8f751824aeb6a41f43
humanhash: football-finch-charlie-leopard
File name:250427-p7bxps1sgx.bin
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'903'104 bytes
First seen:2025-04-27 13:01:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'861 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:u+QDGhYDeGhknPUBlgqL80XOvRCwYTY5H5:eGhgeGhOPeldL80iCFY5
TLSH T1F195336A99ED616AC5BC02B8631FD75CC8412391FCB7769C9E688717C587B0ADCE0E0C
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter UNP4CK
Tags:LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-04-27 12:56:24 UTC
Tags:
lumma stealer amadey botnet loader auto-reg credentialflusher rdp auto-sch themida telegram autoit
Link:
https://app.any.run/tasks/cec0c9fd-3e13-45d0-a577-233f81ae329d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/4291/
Detection(s):
SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=680e2a04cc5fb3600cc348ee
Tags:
vmdetect phishing autorun emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm entropy masquerade packed packed packer_detected rat virtual
Link:
https://www.filescan.io/uploads/680e2ad4212716475faf80da/reports/be0cbc6b-fc7a-4b23-bd56-4e36eed549f1/overview
Verdict:
Malicious
Labled as:
Symmi.Generic
Link:
https://www.hybrid-analysis.com/sample/6e81d52980b66608b0610004e9e39e044322b93aaa3cf6a714de44f273c8ef50
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/92fc0769-5bbe-4936-8fcd-c9a8ce303138
Result
Threat name:
Amadey, Credential Flusher, Healer AV Di
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1675457
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Creates HTA files
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found malware configuration
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Powershell drops PE file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell download and execute file
Sigma detected: PowerShell DownloadFile
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to download and execute files (via powershell)
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected Credential Flusher
Yara detected Healer AV Disabler
Yara detected LummaC Stealer
Yara detected obfuscated html page
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1675457 Sample: 250427-p7bxps1sgx.bin.exe Startdate: 27/04/2025 Architecture: WINDOWS Score: 100 111 youtube.com 2->111 113 youtube-ui.l.google.com 2->113 115 36 other IPs or domains 2->115 131 Suricata IDS alerts for network traffic 2->131 133 Found malware configuration 2->133 135 Antivirus detection for URL or domain 2->135 137 24 other signatures 2->137 10 saved.exe 4 25 2->10         started        15 250427-p7bxps1sgx.bin.exe 1 2->15         started        17 810f95d05f.exe 2->17         started        19 4 other processes 2->19 signatures3 process4 dnsIp5 125 185.39.17.163, 49700, 49702, 49705 RU-TAGNET-ASRU Russian Federation 10->125 91 C:\Users\user\AppData\...\a54731d174.exe, PE32 10->91 dropped 93 C:\Users\user\AppData\...\e503609905.exe, PE32 10->93 dropped 95 C:\Users\user\AppData\...\70378ae55e.exe, PE32 10->95 dropped 101 5 other malicious files 10->101 dropped 173 Contains functionality to start a terminal service 10->173 175 Creates multiple autostart registry keys 10->175 21 810f95d05f.exe 1 10->21         started        25 70378ae55e.exe 9 1 10->25         started        27 a54731d174.exe 10->27         started        29 e503609905.exe 10->29         started        127 185.39.17.162, 49694, 49703, 49707 RU-TAGNET-ASRU Russian Federation 15->127 129 clarmodq.top 104.21.85.126, 443, 49684, 49686 CLOUDFLARENETUS United States 15->129 97 C:\Users\...\14QEUI0IGXHPZMWVYC1LC5342SZB.exe, PE32 15->97 dropped 177 Detected unpacking (changes PE section rights) 15->177 179 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->179 181 Query firmware table information (likely to detect VMs) 15->181 195 5 other signatures 15->195 31 14QEUI0IGXHPZMWVYC1LC5342SZB.exe 4 15->31         started        99 C:\...\4DXTVPD3MPTYHKNRVICIEJU085OCGD4.exe, PE32 17->99 dropped 183 Tries to harvest and steal ftp login credentials 17->183 185 Tries to harvest and steal browser information (history, passwords, etc) 17->185 187 Tries to steal Crypto Currency Wallets 17->187 189 Tries to steal from password manager 17->189 33 chrome.exe 17->33         started        36 chrome.exe 17->36         started        191 Suspicious powershell command line found 19->191 193 Tries to download and execute files (via powershell) 19->193 38 firefox.exe 19->38         started        40 powershell.exe 19->40         started        file6 signatures7 process8 dnsIp9 85 C:\Users\user\...\WNVR47IZI3VUKO83YAJIKV.exe, PE32 21->85 dropped 139 Antivirus detection for dropped file 21->139 141 Multi AV Scanner detection for dropped file 21->141 143 Detected unpacking (changes PE section rights) 21->143 159 8 other signatures 21->159 42 WNVR47IZI3VUKO83YAJIKV.exe 21->42         started        145 Tries to detect sandboxes and other dynamic analysis tools (window names) 25->145 147 Modifies windows update settings 25->147 149 Disables Windows Defender Tamper protection 25->149 161 2 other signatures 25->161 87 C:\Users\user\AppData\Local\...\sCAE151lX.hta, HTML 27->87 dropped 151 Creates HTA files 27->151 45 mshta.exe 27->45         started        47 cmd.exe 27->47         started        153 Binary is likely a compiled AutoIt script file 29->153 60 6 other processes 29->60 89 C:\Users\user\AppData\Local\...\saved.exe, PE32 31->89 dropped 155 Contains functionality to start a terminal service 31->155 157 Contains functionality to inject code into remote processes 31->157 49 saved.exe 31->49         started        105 192.168.2.6, 138, 443, 49159 unknown unknown 33->105 51 chrome.exe 33->51         started        54 chrome.exe 36->54         started        107 prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216, 443, 49764, 49806 GOOGLEUS United States 38->107 109 127.0.0.1 unknown unknown 38->109 56 firefox.exe 38->56         started        58 conhost.exe 40->58         started        file10 signatures11 process12 dnsIp13 163 Suspicious powershell command line found 45->163 165 Tries to download and execute files (via powershell) 45->165 62 powershell.exe 45->62         started        167 Uses schtasks.exe or at.exe to add and modify task schedules 47->167 66 conhost.exe 47->66         started        68 schtasks.exe 47->68         started        169 Multi AV Scanner detection for dropped file 49->169 171 Contains functionality to start a terminal service 49->171 117 192.178.49.196, 443, 49750, 49751 GOOGLEUS United States 51->117 119 plus.l.google.com 51->119 123 3 other IPs or domains 51->123 121 www.google.com 142.250.69.4, 443, 49721, 49722 GOOGLEUS United States 54->121 70 svchost.exe 60->70 injected 72 conhost.exe 60->72         started        74 conhost.exe 60->74         started        76 3 other processes 60->76 signatures14 process15 file16 103 TempYSNYASXHTDGIQGCUYZ9GSSLFAABUO8SM.EXE, PE32 62->103 dropped 205 Powershell drops PE file 62->205 78 TempYSNYASXHTDGIQGCUYZ9GSSLFAABUO8SM.EXE 62->78         started        81 conhost.exe 62->81         started        83 70378ae55e.exe 70->83         started        signatures17 process18 signatures19 197 Multi AV Scanner detection for dropped file 78->197 199 Hides threads from debuggers 83->199 201 Tries to detect sandboxes / dynamic malware analysis system (registry check) 83->201 203 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 83->203
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6e81d52980b66608b0610004e9e39e044322b93aaa3cf6a714de44f273c8ef50
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e81d52980b66608b0610004e9e39e044322b93aaa3cf6a714de44f273c8ef50/
Threat name:
Win32.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-04-27 12:56:31 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2a5kkmawztarmdbaacoty46arbsfoj2vi6pnjyu3zcpe46i55ia._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
error
LummaStealer
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma defense_evasion discovery spyware stealer
Link:
https://tria.ge/reports/250427-p9wpwstny2/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Checks BIOS information in registry
Identifies Wine through registry keys
Reads user/profile data of local email clients
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://clarmodq.top/qoxo
https://geographys.run/eirq
https://woodpeckersd.run/glsk
https://mqtropiscbs.live/iuwxx
https://buzzarddf.live/ktnt
https://biosphxere.digital/tqoa
https://parakehjet.run/kewk
https://n-ubearjk.live/benj
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2fe57c46-443e-4fd3-a61c-62aaeecd76a1
Unpacked files
SH256 hash:
6e81d52980b66608b0610004e9e39e044322b93aaa3cf6a714de44f273c8ef50
MD5 hash:
ee05be9e7e7b7e8f751824aeb6a41f43
SHA1 hash:
945ea40ec5e0e66fbe34528a9eb7ed038f0b2a7b
Link:
https://www.unpac.me/results/46acbb50-6470-4167-b9ca-10e35b02007d/
SH256 hash:
878a4bd35fe8fc8591e8e59f1035ae6a711cf557888668ddbd8fc5ff0f29f68f
MD5 hash:
407fc5d4b68e76652873b41359200ec8
SHA1 hash:
5cc1bad020044f76b1e3762fbb62fec4148ee461
Link:
https://www.unpac.me/results/46acbb50-6470-4167-b9ca-10e35b02007d/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6e81d52980b6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e81d52980b66608b0610004e9e39e044322b93aaa3cf6a714de44f273c8ef50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/4291/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments