MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bde0fbcc81974a22c1c9c7d6fc7e73860a8f5cbf07ddd4a675fa2d0e25dca3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9bde0fbcc81974a22c1c9c7d6fc7e73860a8f5cbf07ddd4a675fa2d0e25dca3d
SHA3-384 hash:	7432e1d5326aae341d76686886ac4150b4f7759d61a6d0ba76223f641f77bf7d27d105a1dac7fa64eb923fcbcef89f2f
SHA1 hash:	726162a8be28a2335b23a1fadd22db44b7b44bff
MD5 hash:	05e8443a4ea2679f8b95c0aa438efa91
humanhash:	washington-oranges-vermont-alanine
File name:	700815a50547b01b29cf3a1ca55d7a7e3058e7d911072018.html.ps1
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	11'296'570 bytes
First seen:	2025-03-31 11:37:32 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	24576:vhodhoRhoJhoWho9hoRhorhoShophoEhoIhoVhoRhochoghochovho/ho3ho0hoG:T
TLSH	T123B6FFDB639C87FDA6988DDE820A354F61F2C1B73C6F128CA9E14507B42FE117625A70
Magika	powershell
Reporter	aachum
Tags:	ClickFix FakeCaptcha LummaStealer ps1

iamaachum

https://a.uueui.shop/700815a50547b01b29cf3a1ca55d7a7e3058e7d911072018.html

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

48

Origin country :

ES

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.14649.18766.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ea81c2cfd0a37f830ac8e7

Tags:

virus crypt spawn

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

crypt masquerade

Link:

https://www.filescan.io/uploads/67ea7ea1f274bf2d8e2a4f44/reports/fd2fda75-e7ca-4adf-a520-ca5f16e61d74/overview

Hybrid Analysis PowerShell/Kryptik.JK trojan

Verdict:

Suspicious

Labled as:

PowerShell/Kryptik.JK trojan

Link:

https://www.hybrid-analysis.com/sample/9bde0fbcc81974a22c1c9c7d6fc7e73860a8f5cbf07ddd4a675fa2d0e25dca3d

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1652754

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9bde0fbcc81974a22c1c9c7d6fc7e73860a8f5cbf07ddd4a675fa2d0e25dca3d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9bde0fbcc81974a22c1c9c7d6fc7e73860a8f5cbf07ddd4a675fa2d0e25dca3d/

ReversingLabs TitaniumCloud Script-PowerShell.Spyware.Lummastealer

Threat name:

Script-PowerShell.Spyware.Lummastealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-31 11:38:13 UTC

File Type:

Text

AV detection:

5 of 24 (20.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tppa7pgidf2kela4tr6w7r7hhbqkr5ol6b652sthl6rnbys5zi6q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/250331-nrrsjsyxfy/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Downloads MZ/PE file

Suspicious use of NtCreateUserProcessOtherParentProcess

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.