🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 63 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa
SHA3-384 hash: 7b92d9b6bc032b6e1c2868a78f40a28b3f6fad914ce78c360c485f5c116b52601c5891b9e01325bbd778f56be6e48b17
SHA1 hash: 055f7ecee82eb03a61442384610fba4fe6d2914f
MD5 hash: a1271541c0098606fb05741ea2dd2ae5
humanhash: hotel-oxygen-three-glucose
File name:mbupload-hknw5po0.bin
Download: download sample
Signature LummaStealer
Create hunting rule
File size:7'438'750 bytes
First seen:2026-10-16 17:26:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:3+jZsqnTTx1AhxC+TOh5OsM5wij6UU/UYqDTV8Krp3nZdty4GbS8cWHNbfE2BCPk:QNTTYXGMVj6UU/UYoJ/7GbBZpfErPMl
TLSH T11F76335DECAE86EED92CE473735BA48721C845E59A84D102DF3202EABFD40CE411F56B
Magika zip
Reporter wristhulk
Tags:LummaStealer zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
US US
File Archive Information

This file archive contains 19 file(s), sorted by their relevance:

File name:general.bat
File size:20 bytes
SHA256 hash: 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
MD5 hash: 69d2d3dec4b85fd93b8f4c0b6717ff24
MIME type:text/plain
Signature LummaStealer
File name:WinDivert64.sys
File size:94'144 bytes
SHA256 hash: 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 hash: 89ed5be7ea83c01d0de33d3519944aa5
MIME type:application/x-dosexec
Signature LummaStealer
File name:ipset-all.txt
File size:0 bytes
SHA256 hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 hash: d41d8cd98f00b204e9800998ecf8427e
MIME type:inode/x-empty
Signature LummaStealer
File name:ipset-all.txt.backup
File size:225'264 bytes
SHA256 hash: 959cf0532016c44570fe8c90dc7557de58c7647f38425afbb42f9b106c238c1a
MD5 hash: b627c0c298847a277ae7071ddfea537b
MIME type:text/plain
Signature LummaStealer
File name:winws.exe
File size:204'288 bytes
SHA256 hash: 31d68a175abebab19f7f39bf6d0845ec5c18ab653eeeea6ee830b22d799b7e55
MD5 hash: f94c4b0110feccd6aeca48c93b278d8b
MIME type:application/x-dosexec
Signature LummaStealer
File name:WinDivert.dll
File size:47'616 bytes
SHA256 hash: c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 hash: b2014d33ee645112d5dc16fe9d9fcbff
MIME type:application/x-dosexec
Signature LummaStealer
File name:tls_clienthello_4pda_to.bin
File size:284 bytes
SHA256 hash: eefeaf09dde8d69b1f176212541f63c68b314a33a335eced99a8a29f17254da8
MD5 hash: e6d649de132c3c10cb62531ef74f5b73
MIME type:application/octet-stream
Signature LummaStealer
File name:test zapret.ps1
File size:37'616 bytes
SHA256 hash: afe31cc4ae3c00f37d001616cf0829fe9e087fd8ba747ca6a7e63495ddd7f7c5
MD5 hash: 8ab659bdf90efc4f98f54bfeaf50f150
MIME type:text/plain
Signature LummaStealer
File name:cygwin1.dll
File size:2'954'293 bytes
SHA256 hash: 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 hash: a1c82ed072dc079dd7851f82d9aa7678
MIME type:application/x-dosexec
Signature LummaStealer
File name:tls_clienthello_max_ru.bin
File size:654 bytes
SHA256 hash: e4a94cec50b3c048eb988a513ee28191e4d7544dd5f98a9bf94f37ee02d2568e
MD5 hash: 2c2f962b7ab31e5a0760027e1f14ac46
MIME type:application/octet-stream
Signature LummaStealer
File name:DiscordFix.exe
File size:7'356'856 bytes
SHA256 hash: 83d2faf575026b3f75446a6337f004f5d81e66d5e2bfa19c44c6ef369fd1ec1a
MD5 hash: 61d8a273b21a32ba2bab80a50c68f3ea
MIME type:application/x-dosexec
Signature LummaStealer
File name:targets.txt
File size:1'246 bytes
SHA256 hash: 4c953196e2649478c267450fc80cef121ef96bc50656ef75336b9589c0808cea
MD5 hash: 0260e9fef4eaf980bda2c0118c2693e1
MIME type:text/plain
Signature LummaStealer
File name:tls_clienthello_www_google_com.bin
File size:681 bytes
SHA256 hash: 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
MD5 hash: 41e47557f16690df1781f67c8712714e
MIME type:application/octet-stream
Signature LummaStealer
File name:ipset-exclude.txt
File size:135 bytes
SHA256 hash: 96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
MD5 hash: 240532f20e114cd6de2906ebc86d683e
MIME type:text/plain
Signature LummaStealer
File name:list-exclude.txt
File size:302 bytes
SHA256 hash: 229499a77dfbe42e7e3e7de0123fcc4a57374aaf3e17fc03345ba2d833fe454d
MD5 hash: be461ae73bc65527da2f6e7c49390842
MIME type:text/plain
Signature LummaStealer
File name:list-google.txt
File size:362 bytes
SHA256 hash: 36ec86bbe19b9e5815d807d6b25dffd01bdf69e9cf6c05d7cf60cd7c9bf036d8
MD5 hash: 0c333bb65317588dc354b5c93e4203ff
MIME type:text/plain
Signature LummaStealer
File name:list-general.txt
File size:863 bytes
SHA256 hash: 1d13588f875a19290455688b6cfbdd096f32cb4bca1f42e9c03b8398246bea61
MD5 hash: a57e85328f1b5d474a4662e2b190db5b
MIME type:text/plain
Signature LummaStealer
File name:quic_initial_www_google_com.bin
File size:1'200 bytes
SHA256 hash: f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
MD5 hash: 312526d39958d89b1f8ab67789ab985f
MIME type:application/octet-stream
Signature LummaStealer
File name:game_filter.enabled
File size:10 bytes
SHA256 hash: 02fa0e83883800772ec3462347e9a9f623fa3e13be7d4de7e0b2cb7e425ab212
MD5 hash: 9e57d6bda4bec067ff636fe400af6ea5
MIME type:text/plain
Signature LummaStealer
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/32a4c508-88bd-4239-b080-4d73e1fe68a1/
Detection(s):
SecuriteInfo.com.not-a-virus.HEUR.RiskTool.Multi.WinDivert.gen.25597.12273.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad25e73f4e17c78f7162e17
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa
Verdict:
Malicious
File Type:
zip
First seen:
2026-10-16T14:36:00Z UTC
Last seen:
2026-10-16T14:53:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Khalesi.rnqb not-a-virus:HEUR:RiskTool.Multi.WinDivert.gen
Link:
https://opentip.kaspersky.com/9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa
Verdict:
Go Loader (Factory-v3)
YARA:
4 match(es)
Tags:
Executable Go Loader (Factory-v3) PDB Path PE (Portable Executable) PE File Layout Stealer Loader T1027 T1055 T1059.001 T1105 Zip Archive
Link:
https://app.malva.re/file/a1271541c0098606fb05741ea2dd2ae5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa/
Threat name:
Win32.Spyware.Salatstealer
Create hunting rule
Status:
Suspicious
First seen:
2026-10-16 17:27:16 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
15 of 24 (62.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvsokjyivn4l6xutwbwubsyihexpremjq7bm5gwc6bir5xuj2sva._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
defense_evasion discovery execution
Link:
https://tria.ge/reports/261016-xtbzjsbz6x/
Behaviour
Direct Volume Access: Opens a physical disk for reading
System Location Discovery: System Language Discovery
Checks for VirtualBox DLLs, possible anti-VM trick
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_all_IPv6_variants
Create hunting rule
Author:Bierchermuesli
Description:Generic IPv6 catcher
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Web_Generic_Binary_URL_Download
Create hunting rule
Author:Serhii Kocherhan
Description:Detects files containing HTTP or HTTPS links pointing directly to .bin payload extensions.
Rule name:WinDivert_Driver
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects WinDivert User-Mode packet capturing driver
Reference:https://www.reqrypt.org/windivert.html
Rule name:Windows_VulnDriver_WinDivert_25991186
Create hunting rule
Author:Elastic Security
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_PsychedelicStealer_ForgeAuto_14838da1_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects PsychedelicStealer (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments