MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0
SHA3-384 hash: 78c1753883419866bc0b7c2ba53597f09b018e34b82b52e9dd6cc62f53189cdb3e5098c019015909c43e36e59a23e021
SHA1 hash: d7dabbb59a19aebc245ba77a5d84d5bbf1ec02bf
MD5 hash: 59570b386a22d40a6c46ccc602fad271
humanhash: utah-five-sink-cardinal
File name:Set-up.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:9'715'712 bytes
First seen:2025-04-06 14:02:18 UTC
Last seen:2025-04-07 15:33:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fed7f0018d82c6d0f11daa2a5f600367 (2 x LummaStealer)
ssdeep 196608:uKYBzwtvLFGGq9Y+eKDRjzcW2RiNrXtV0IwA0Bm:YwtzFGGq9Y+nDRjzcW3xV0IwAEm
TLSH T138A6AF227A81C4B9C2710271796DB7BE97BDBE600F3191E363883B2D2E705C16E35A57
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon 12b1f8b696cc71b2 (2 x LummaStealer)
Reporter abuse_ch
Tags:de-pumped exe LummaStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
55
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Set-up.exe
Verdict:
Malicious activity
Analysis date:
2025-04-06 14:10:24 UTC
Tags:
stealer lumma loader delphi crypto-regex
Link:
https://app.any.run/tasks/05589e89-2bf0-43b2-b9ea-53c818a3a887

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lumma
Create hunting rule
Link:
https://www.capesandbox.com/analysis/932/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f289c1e011fe619faba165
Tags:
vmdetect dropper shell sage
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-vm crypto expand explorer fingerprint iceid keylogger lolbin microsoft_visual_cc overlay
Link:
https://www.filescan.io/uploads/67f2899d2d430c849e08ee1c/reports/b7124af0-a29b-4b05-acaa-730b0697726a/overview
Verdict:
Suspicious
Labled as:
Trojan.GenHeur
Link:
https://www.hybrid-analysis.com/sample/8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0
Malware family:
LummaC2 Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4df9c2c5-aad4-40fe-8cce-cd9ee0e188a6
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1657802
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates HTML files with .exe extension (expired dropper behavior)
Found malware configuration
Malicious sample detected (through community Yara rule)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
11%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Malicious
First seen:
2025-04-06 14:03:14 UTC
File Type:
PE (Exe)
Extracted files:
567
AV detection:
12 of 24 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=re46mlljk6ptgenvm4bp7krt4bvkcvz3vxbnfxlo7w2ikaivi3ia._file
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery spyware stealer
Link:
https://tria.ge/reports/250406-rcq49azwdt/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Checks installed software on the system
Reads user/profile data of local email clients
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://zestyasd.run/igsup
https://jrxsafer.top/shpaoz
https://gplantainklj.run/opafg
https://puerrogfh.live/iqwez
https://quavabvc.top/iuzhd
https://radvennture.top/GKsiio
https://targett.top/dsANGt
https://rambutanvcx.run/adioz
https://6ywmedici.top/noagis
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/da3719d4-64d8-477f-8736-69517bb74d20
Unpacked files
SH256 hash:
8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0
MD5 hash:
59570b386a22d40a6c46ccc602fad271
SHA1 hash:
d7dabbb59a19aebc245ba77a5d84d5bbf1ec02bf
Link:
https://www.unpac.me/results/8a836331-6d46-471a-829b-10a98538ad1a/
SH256 hash:
b6e6398945aa225c5f0d4fc8182f5ab7f818b89518ef7d0371d63bf1b857d0f9
MD5 hash:
4e217aaf82ef8359e8fb7636edb28e6c
SHA1 hash:
cd10051e76121900da3bc6b02ea423d2e1da50a8
Detections:
win_lumma_auto
Create hunting rule
LummaStealer
Create hunting rule
Link:
https://www.unpac.me/results/8a836331-6d46-471a-829b-10a98538ad1a/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8939e62d6957/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

7z a9b6aaaea37305c58e2076e65663542c0506ff4440a0fdec32e7ac618d6d4ef1

LummaStealer

Executable exe 8939e62d69579f3311b56702ffaa33e06aa1573badc2d2dd6efdb485011546d0

(this sample)

  
Dropped by
MD5 2c0b48a6978d44072f598059ff0e57a9
  
Dropped by
SHA256 a9b6aaaea37305c58e2076e65663542c0506ff4440a0fdec32e7ac618d6d4ef1
Cape
Cape
https://www.capesandbox.com/analysis/932/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoFreeUnusedLibraries
ole32.dll::CreateStreamOnHGlobal
DP_APIUses DP APICRYPT32.dll::CryptProtectMemory
CRYPT32.dll::CryptUnprotectMemory
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipGetImageEncodersSize
gdiplus.dll::GdipGetImageEncoders
gdiplus.dll::GdipDeleteGraphics
gdiplus.dll::GdipAlloc
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciGetErrorStringW
WINMM.dll::mciSendCommandW
GDI32.dll::StretchDIBits
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::GetFileSecurityW
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::FindExecutableW
SHELL32.dll::ShellExecuteW
SHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::OpenSemaphoreW
KERNEL32.dll::CloseHandle
WINHTTP.dll::WinHttpCloseHandle
KERNEL32.dll::CreateThreadpoolWait
KERNEL32.dll::CreateThreadpoolTimer
KERNEL32.dll::CreateThreadpoolWork
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetVolumeInformationW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleScreenBufferInfo
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileA
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptCreateHash
bcrypt.dll::BCryptDestroyHash
bcrypt.dll::BCryptFinishHash
bcrypt.dll::BCryptGetProperty
bcrypt.dll::BCryptHashData
bcrypt.dll::BCryptOpenAlgorithmProvider
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CertFreeCertificateChain
CRYPT32.dll::CertFreeCertificateContext
CRYPT32.dll::CertGetCertificateChain
CRYPT32.dll::CertVerifyCertificateChainPolicy
ADVAPI32.dll::CryptAcquireContextW
ADVAPI32.dll::CryptCreateHash
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpAddRequestHeaders
WINHTTP.dll::WinHttpConnect
WINHTTP.dll::WinHttpGetDefaultProxyConfiguration
WINHTTP.dll::WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll::WinHttpGetProxyForUrl
WINHTTP.dll::WinHttpOpenRequest
WINHTTP.dll::WinHttpOpen
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegQueryValueW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments