MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 6 File information Comments

SHA256 hash:	7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48
SHA3-384 hash:	2de47e401323fdb2fdae3be7281b4cabb46496017b5fd63aa5c5157fcfc1f82ca5cae7e6e32485bdb23ab3afb640643c
SHA1 hash:	24868dd0adf9c774c3c63bdb2bcbd7e626d79f84
MD5 hash:	e852acc1b5da0ab6479345bd6787cbda
humanhash:	crazy-aspen-autumn-sink
File name:	file
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	897'576 bytes
First seen:	2025-09-09 04:00:15 UTC
Last seen:	2025-09-10 04:00:28 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b2c81b106d11ae81264a5fbcab0aae8b (11 x LummaStealer, 4 x Rhadamanthys, 1 x Stealc)
ssdeep	12288:4P5uVJjHWJGTRYeOME3EY+9tJuxsptYOGn/9DeqSYIhReuxAeCRVENqWpEO:4KKGdBLt4K659DeDYkxwEt
Threatray	313 similar samples on MalwareBazaar
TLSH	T1F815E025A1A253FAE1AA44B14A469501F833BC6387746FEF43E0D6761E17BE01F3E325
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe LummaStealer

Bitsight

url: http://178.16.54.200/files/7453936223/RenT7Wg.exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

250611-q7zt7svwgw.bin.exe

Verdict:

Malicious activity

Analysis date:

2025-09-09 01:49:49 UTC

Tags:

loader stealer github stealc ultravnc rmm-tool pastebin evasion auto coinminer miner auto-sch-xml snake keylogger amadey redline botnet lumma anti-evasion telegram vidar purelogs gcleaner payload reverseloader zerotrace susp-powershell

Link:

https://app.any.run/tasks/0ffd1ea9-1639-49d8-8efe-46f4ccff40eb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/26396/

Detection(s):

Win.Packed.Lazy-10057857-0

Win.Packed.Lazy-10057858-0

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68bfa679b20052598879126d

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context crypt fingerprint infostealer invalid-signature lumma microsoft_visual_cc packed signed unsafe

Link:

https://www.filescan.io/uploads/68bfa67ba1a41633174e06d7/reports/3f414568-89a4-461e-93ba-9dc96cc47dd8/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-09-08T18:54:00Z UTC

Last seen:

2025-09-08T18:54:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Win32.Lumma.sb Trojan-PSW.Vidar.HTTP.C&C Trojan.Win32.InjectorNetT.chx Trojan.Win32.Inject.sb PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/37390f2e-348f-438d-b9c6-975c253666cd

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/e852acc1b5da0ab6479345bd6787cbda

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48/

Verdict:

Malicious

Threat:

Family.LUMMA

Link:

https://tip.neiki.dev/file/7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48

Threat name:

Win64.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-09-09 02:12:54 UTC

File Type:

PE+ (Exe)

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p3dsmj3cvpbj4volnz35qz2ppplvzso2hfp6uguvtzhp6nrofvea._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

41979cb6a17c15962a9c3e2835c70fda67182c3a5e2dc81f1b02412399256d63

LummaStealer

5e6e516c43ba268c6ff1bc4dc1b673b6ae53f2415867a64a353dc1ca59118b61

LummaStealer

6010fce772793e35168d6216a5127bcbbd68829b0d80ea7bb5e7289c0ddd0643

LummaStealer

61b0374c1c5cb8194b2bba4ca0d8b05417cbc442cfd82ab62e083b13d2ab15ce

LummaStealer

7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48

LummaStealer

error

LummaStealer

+ 303 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/250909-ek3rssyry2/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://voando26.com/iwnn
https://dubznetwork.com/wqii
https://digitbasket.com/pqox
https://iaed.link/ndbh
https://pyscalp.com/iqop
https://lzh.fr/mnsn
https://streamin.style/iqzb
https://phoenix-brands.dev/qyzb

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9ff651f7-3fcd-40c5-bb09-87026a0e6416

Unpacked files

SH256 hash:

7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48

MD5 hash:

e852acc1b5da0ab6479345bd6787cbda

SHA1 hash:

24868dd0adf9c774c3c63bdb2bcbd7e626d79f84

Link:

https://www.unpac.me/results/63f4396b-a1d6-4b23-8238-b8c0d67328cd/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7ec7262762ab/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7ec7262762abc29e55cb6e77d8674f7bd75cc9da395fea1a959e4eff362e2d48

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)