MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482
SHA3-384 hash: 83c948e5b94ed8ee9b8041f060aeb4d35209128358a91ad15d8cd77816fc9a0426fc16b648a6ad8c51845d7161ca600d
SHA1 hash: 784a77b94118dcd8554643344419f24ff397d013
MD5 hash: ef544963f81866ea178486b72ad19e5a
humanhash: batman-ten-violet-river
File name:file
Download: download sample
Signature LummaStealer
Create hunting rule
File size:2'005'504 bytes
First seen:2025-09-04 04:01:05 UTC
Last seen:2025-09-06 04:05:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:6Wr/yiGIy0G5cavkon0bZE3ou7hHeI/lSH39B:6h0GOavhcXOzdSH
Threatray 719 similar samples on MalwareBazaar
TLSH T12D95120A2A008FA0C6E834BE9DB9556E4178F4A1A7A37113D7B0CB91F552EB73E35734
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe LummaStealer


Avatar
Bitsight
url: http://178.16.55.189/files/5900855435/YXJ9Hvg.exe

Intelligence

File Origin
# of uploads :
20
# of downloads :
114
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
7e31e16181a903414194d84336d0faa96866e3a21836597a2b6c816bffadcab0.exe
Verdict:
Malicious activity
Analysis date:
2025-09-03 23:08:24 UTC
Tags:
auto redline stealer amadey botnet lumma arch-exec loader themida auto-reg telegram auto-startup auto-sch purelogs stealc rdp xor-url generic vidar zerotrace autoit delphi antivm gcleaner
Link:
https://app.any.run/tasks/b3caacf4-1e7a-467b-b9d9-b48b86650044

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lumma
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24977/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b90f2feb163e0ec1844542
Tags:
vmdetect phishing
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Malicious
Labled as:
Symmi.Generic
Link:
https://www.hybrid-analysis.com/sample/97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-03T17:46:00Z UTC
Last seen:
2025-09-03T17:46:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Win32.Lumma.sb HEUR:Trojan-PSW.Win32.Lumma.pef HEUR:Trojan.Win32.Generic VHO:Trojan-PSW.Win32.Lumma.gen not-a-virus:VHO:RiskTool.Win32.BitCoinMiner.gen
Link:
https://opentip.kaspersky.com/97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cc11cf8f-b56b-421e-b2f4-0c1a9386ac0a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/ef544963f81866ea178486b72ad19e5a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-09-04 01:25:24 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s6zffzpwsm2ndffxodhuuxlihhqfhdzjiln6xcaxagihkg7xesba._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
102c57004decd2173d86522467863123425f1ecccf37561fa34fca5c1de1c402
LummaStealer
13f20829a62b48bb156974b56e5d7d7b39f6660ddbe9716b97ba9cac435617fe
LummaStealer
2fd3d4a53dba424e61cab4f1f7b2f6d02079e0d0f06ed91dcc9f5214b1ee174a
LummaStealer
31ee08e0aad9297988beb54957c0fa5bce2d9b1d0d2c16e4932e247c73c19348
LummaStealer
6b023387ea48536d7900b1caff4c3568eb8761b55e0559b5680258bf28c55eec
LummaStealer
8cd2c50d76ca6672c8f99a66343af62f3a41c35a141f478f55044198ba8147c9
LummaStealer
a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7
LummaStealer
cb1ee7fa3edcc9795877868ad56cf32b9d6c3d95ea59d348e55c2b5caf87a180
LummaStealer
cdb8d74735fd803936cbb3f259418fa76aa5fa7ad03f8cba3b7d310006052e61
LummaStealer
e9b303f24082eaf87853558d2d427ad2eecc78acd538d37e1f4397d378b47c27
LummaStealer
+ 709 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma defense_evasion discovery spyware stealer
Link:
https://tria.ge/reports/250904-elre6azyfy/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Modifies trusted root certificate store through registry
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks BIOS information in registry
Identifies Wine through registry keys
Reads user/profile data of web browsers
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://limcuz.ru/wotr
https://mastwin.in/qsaz
https://noggs.ru/yopd
https://georgej.ru/plnb
https://oneflof.ru/tids
https://epitherd.ru/zadw
https://backab.ru/lkdo
https://eigwos.ru/wqex
https://kimmenkiz.ru/zldw
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/dd7d1658-708a-4432-97b1-1fc449040b62
Unpacked files
SH256 hash:
93b5b80b0ac89b4621138770313dd9097c7fc3a05ae56f75ee71f8b9983d2ab4
MD5 hash:
d3a3a8311acaf2b0867ad392f65e7229
SHA1 hash:
9c2afaf595e93ac5f6f02cb80c4cd0955d74f710
Link:
https://www.unpac.me/results/c6bfd47b-a86f-41d6-a414-b2e4585e5694/
SH256 hash:
97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482
MD5 hash:
ef544963f81866ea178486b72ad19e5a
SHA1 hash:
784a77b94118dcd8554643344419f24ff397d013
Link:
https://www.unpac.me/results/c6bfd47b-a86f-41d6-a414-b2e4585e5694/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/97b252e5f693/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Lumma
Create hunting rule
Author:kevoreilly
Description:Lumma Payload
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

Executable exe 97b252e5f69334d194b770cf4a5d6839e0538f2942dbeb88170190751bf72482

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3612338/
Cape
Cape
https://www.capesandbox.com/analysis/24977/

Comments