MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e
SHA3-384 hash:	764f3aba03d5a808c9748e3cb926b708a5a49137c5cb1bda37795323efbf20bcb9c77d979a94d229e5e20b385ca4f6d6
SHA1 hash:	522a15bda8399112017c59bce4bdfb0bbe464529
MD5 hash:	809a3665d1d1b88f42c2f7d14e874a6d
humanhash:	monkey-red-sierra-mobile
File name:	XPSPLOG.dll
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	4'816'928 bytes
First seen:	2025-09-26 04:51:56 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	b4ca6f0ad0fe5ce382aa3bee0f2fba93 (1 x LummaStealer)
ssdeep	98304:rAy6vQvedEhfukYe5p1IUDet73oEvws1nweUJ:UvBcb5p1IHtr1nwbJ
TLSH	T1452633C09EF218E8E44C72B826833FBD317BEE7611209F1C58A476EB8DD6526643574B
TrID	30.2% (.EXE) Win64 Executable (generic) (10522/11/4) 18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 14.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.9% (.EXE) Win32 Executable (generic) (4504/4/1) 5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	GDHJDSYDH1
Tags:	backdoor dll dllHijack lumma LummaStealer VMProtect

Intelligence

File Origin

# of uploads :

# of downloads :

598

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/29108/

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.9928552698.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68d61af11e4783989051fc2f

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lumma overlay packed redcap unsafe zusy

Link:

https://www.filescan.io/uploads/68d61c16674d5fd6aa0d3312/reports/b545d4ca-3f79-4d75-8ec0-bd3448657208/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e

Verdict:

Malicious

File Type:

dll x32

First seen:

2025-09-26T01:39:00Z UTC

Last seen:

2025-09-26T01:39:00Z UTC

Hits:

~10

Detections:

Trojan.Win64.DLLhijack.bcr

Link:

https://opentip.kaspersky.com/8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/46f52fb1-2322-42ff-9fc5-87b8be25523f

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/809a3665d1d1b88f42c2f7d14e874a6d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e/

Verdict:

Malicious

Threat:

Win32.Infostealer.Tinba

Link:

https://tip.neiki.dev/file/8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e

Threat name:

Win32.Infostealer.Tinba

Status:

Malicious

First seen:

2025-09-26 04:38:08 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ru2xwssaobjxw6oiu7dhge5uxrnu7wdqtw3mrguj26qq26hyooha._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250926-fhpb3adq31/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Unpacked files

SH256 hash:

8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e

MD5 hash:

809a3665d1d1b88f42c2f7d14e874a6d

SHA1 hash:

522a15bda8399112017c59bce4bdfb0bbe464529

Link:

https://www.unpac.me/results/e6d44eeb-1d0e-4e78-8c6e-029a52c2536f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication