MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88e9ae317e3475aafee18b2c1445e81e25e08f545702f2d7cebf270058553764. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88e9ae317e3475aafee18b2c1445e81e25e08f545702f2d7cebf270058553764
SHA3-384 hash: 909e5e212a2173e697e00fd198dd345f571ed8b1d3b286f13bae0b18028f53160d66d6121934d2eaf6b14f39fe668cf1
SHA1 hash: 3bf57fdd13a3dad4d9c096f86fb2a3aa8a40cfe7
MD5 hash: caccd07e3ef250887519851ea048c522
humanhash: johnny-carbon-jupiter-arizona
File name:InstaIIеr-86х.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'102'835 bytes
First seen:2025-09-10 16:26:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b729b61eb1515fcf7b3e511e4e66258b (70 x LummaStealer, 16 x Rhadamanthys, 8 x Adware.Generic)
ssdeep 24576:sVDCTeC+ZdHg45S8gsgICrLmCPclgOWK379DtwE:stCIf5S3DNPFM3JDtH
Threatray 904 similar samples on MalwareBazaar
TLSH T15D353391C8AADCAED317E37CB93B2C114EBAB308ED346777437004585E33A49D91A769
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter AntiSkidding
Tags:exe fake-cheat LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
InstaIIеr-86х.exe
Verdict:
Malicious activity
Analysis date:
2025-09-10 16:28:20 UTC
Tags:
autoit telegram lumma stealer
Link:
https://app.any.run/tasks/c2c39648-d963-4c66-b49d-b7df0f4d5af7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/26742/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c1a6be6e66ba602d79f862
Tags:
autoit emotet nsis
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Searching for the window
Searching for the Windows task manager window
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Launching a process
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
installer microsoft_visual_cc obfuscated overlay packed packed packer_detected
Link:
https://www.filescan.io/uploads/68c1a6b0c62f699623884eb4/reports/e0ee23e7-8272-432a-8282-71ab02dfac39/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/88e9ae317e3475aafee18b2c1445e81e25e08f545702f2d7cebf270058553764
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-10T14:44:00Z UTC
Last seen:
2025-09-10T14:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/88e9ae317e3475aafee18b2c1445e81e25e08f545702f2d7cebf270058553764/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0f3d3e10-20ea-4691-a0d5-f02a3b4dc219
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/88e9ae317e3475aafee18b2c1445e81e25e08f545702f2d7cebf270058553764
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88e9ae317e3475aafee18b2c1445e81e25e08f545702f2d7cebf270058553764/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Suspicious
First seen:
2025-09-10 16:27:38 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
20 of 38 (52.63%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdu24ml6gr22v7xbrmwbirpidys6bd2uk4bpfv6ox4tqawcvg5sa._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
02f884ba8ca16bfd9fa50384ead367ac2378840ca3c0810538ba80f216ba502a
LummaStealer
072114eba4f486f0f8e006bf8406164eefc0fee4f92a79f5ad2cf343ee212231
LummaStealer
2646ca597f90c084f80741cf122b58e55767582135a7d90e93cd6ffd165e9d4b
LummaStealer
310f9fc95d222a94494e8cdd51251999c40ac054bfa6b1d543f25679605572fa
LummaStealer
5386af6b4fbc057a092ce7fbe3b52702aae6242ff24c0486d7b073dc4a078687
LummaStealer
7cdad39df0e0cc2d9f14ba21919da8f96d8e8d1f4383815752133748cfd3c9dd
LummaStealer
b43062d0da3f51c606d5fe3eea69af68e4b8c5bdbef33a97e0cfa12ad7d60212
LummaStealer
cf98c0de9a639b1a96d1bb1a6f14e4d0a4cf9d4485a2eed09d50a430d6dd35eb
LummaStealer
error
LummaStealer
f87d471762bd42cdc93ad464b7b22d8b9205beca242c7529eda5f39a4ad1b98f
LummaStealer
+ 894 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery spyware stealer
Link:
https://tria.ge/reports/250910-txsvpa1wg1/
Behaviour
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Enumerates processes with tasklist
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://t.me/fhetj653u
https://laputau.qpon/rlxz
https://diadtuky.su/texz
https://sirhirssg.su/xzde
https://prebwle.su/xazd
https://rhussois.su/tatr
https://todoexy.su/xqts
https://acrislegt.su/tazd
https://averiryvx.su/zadr
https://cerasatvf.su/qtpd
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8b39d277-32b9-4f2f-a4e5-a28867a296ae
Unpacked files
SH256 hash:
bb4fb924885b8d6719cb88e7f231abcbb7c2a1c69be92a12ce7bb56bed9129e3
MD5 hash:
094ae615109634f48bede4a612e36fc8
SHA1 hash:
a8b8cbf4d8a7f368b3ae53090bab40a2793657eb
Link:
https://www.unpac.me/results/bb9f698a-06ae-4fc9-a449-9285ebf81d33/
SH256 hash:
8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 hash:
08e9796ca20c5fc5076e3ac05fb5709a
SHA1 hash:
07971d52dcbaa1054060073571ced046347177f7
Link:
https://www.unpac.me/results/bb9f698a-06ae-4fc9-a449-9285ebf81d33/
SH256 hash:
88e9ae317e3475aafee18b2c1445e81e25e08f545702f2d7cebf270058553764
MD5 hash:
caccd07e3ef250887519851ea048c522
SHA1 hash:
3bf57fdd13a3dad4d9c096f86fb2a3aa8a40cfe7
Link:
https://www.unpac.me/results/bb9f698a-06ae-4fc9-a449-9285ebf81d33/
Malware family:
CypherIt
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/88e9ae317e34/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88e9ae317e3475aafee18b2c1445e81e25e08f545702f2d7cebf270058553764

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/26742/

Comments