MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f
SHA3-384 hash:	1bb824432814866e8e2dec1204bc7951c9d5608911ebf54835542fd23c0826729fe03ce51889d1ac12f25b7bf0d542a5
SHA1 hash:	f8495beaedb2311089ed6da3996931b00bbf91b3
MD5 hash:	bf52cad669bf7758c2935d51311189aa
humanhash:	seven-fruit-fix-princess
File name:	SecuriteInfo.com.Win64.MalwareX-gen.10700.1954
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'204'736 bytes
First seen:	2025-07-23 07:22:48 UTC
Last seen:	2025-07-23 08:27:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7ac3055e5399ccd86c2cd35aa54238b2 (11 x LummaStealer, 3 x Stealc, 2 x Rhadamanthys)
ssdeep	24576:Y1p7S/b3eZbRMzLbuECwbTeowgXMzLbuECwbTeowgw:m2/SULyECwbTeMULyECwbTe7
Threatray	43 similar samples on MalwareBazaar
TLSH	T11B45F115A662A3EAF1A680B559069140F922BDAB4734AEFF43E0C2271F17FD41F3D316
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

94b7fe5ae968e09ee74cd56ce63999103d2f2eb038a1f29bada1195a07642a21.bin.exe

Verdict:

Malicious activity

Analysis date:

2025-07-22 22:01:52 UTC

Tags:

lumma stealer themida loader amadey botnet rdp auto-reg clipper diamotrix

Link:

https://app.any.run/tasks/77512ade-29a8-4c35-9171-f269350db63c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Lumma

Link:

https://www.capesandbox.com/analysis/16440/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.10700.1954.UNOFFICIAL

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68808dfa2f623871a5f24e12

Tags:

virus krypt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/3b4d6a4f-cfde-41d1-9685-11a32c507c02

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 64 Exe x64

Link:

https://app.malva.re/file/bf52cad669bf7758c2935d51311189aa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f/

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.TCP

Link:

https://tip.neiki.dev/file/91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f

Threat name:

Win64.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-07-23 07:23:30 UTC

File Type:

PE+ (Exe)

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sglsemujj2xl2nncf23s42nhx5j4emo5cpcoqcsqg4hcu6wxmi7q._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

26f441d9c0ad5c0fe48fb4c64c8e70267574282e0688938d991a8db413ad13bf

LummaStealer

40b81762bf39deebcb719c372ce9bf3249b28a97905bd745a7560eeca3179fd8

LummaStealer

89b87ee6778b2c3349c1a18d6f4e75b8c29031695460d452fb4fbe5add6f3902

LummaStealer

ba84b278c93868642b44b35cc9979c678cde2abdc3ac7e5f92be7e5b0ed329d2

LummaStealer

c8e923c98bceb0c115150eb6dd0a6fd03026780e0ed785bbdaabf089c6e45f1b

LummaStealer

error

LummaStealer

+ 33 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/250723-h7z6zack51/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://mosaicia.top/zlap
https://worlejrc.xyz/xaiw
https://corronxu.xyz/xowq
https://ultracpj.xyz/apgk
https://keepnody.top/tiow
https://seruneqy.live/akiz
https://siniavzv.life/xajz
https://familkqo.xyz/xlak

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/73cfe273-2d60-4e57-b10c-2f4de1ffc21e

Unpacked files

SH256 hash:

91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f

MD5 hash:

bf52cad669bf7758c2935d51311189aa

SHA1 hash:

f8495beaedb2311089ed6da3996931b00bbf91b3

Link:

https://www.unpac.me/results/b179fa03-7bf1-4501-a1e2-848daed4e872/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 91972232894eaebd35a22eb72e69a7bf53c231dd13c4e80a50370e2a7ad7623f

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3588298/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/16440/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW
WIN_USER_API	Performs GUI Actions	USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample