MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 2 File information Comments

SHA256 hash:	a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e
SHA3-384 hash:	5f5842f80e176a9451ba257e52222a119c07999ac71124b3db5d0976005e8e4eaca54bf18f355f99655d449691dda29a
SHA1 hash:	125ad706b226eba77a7a8addb21a7fd09d4ce172
MD5 hash:	e50edd7f8b7dfc55b076079ad134eafc
humanhash:	snake-leopard-magnesium-coffee
File name:	250428-heb9faxqw7.bin
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'258'508 bytes
First seen:	2025-04-28 06:44:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bf95d1fc1d10de18b32654b123ad5e1f (327 x LummaStealer, 65 x Rhadamanthys, 25 x Vidar)
ssdeep	24576:RtCsXI+/pqs0fx4kQToI5nJAoz0MTCTrsS7RImM9/wcSZOv//g:RDEs0ZQToI5nbCTraN9/wcSZOY
Threatray	61 similar samples on MalwareBazaar
TLSH	T15B4533A1829044E1D5F34A34A1D1C7EFFAB3FC484881D1D792251E62DB37DA19F4FAA8
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	64e0c0d8d2e46464 (2 x LummaStealer)
Reporter	UNP4CK
Tags:	LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

krutoy.exe

Verdict:

Malicious activity

Analysis date:

2025-04-28 06:41:34 UTC

Tags:

autoit stealer lumma autoit-loader

Link:

https://app.any.run/tasks/a0bb49fc-b7f3-425f-8123-413f9ff8ad34

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Lumma

Link:

https://www.capesandbox.com/analysis/4651/

Detection(s):

SecuriteInfo.com.AutoIt.Agent-AOQ.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680f231ec8b2e86d0ac39e79

Tags:

phishing autoit emotet

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a file

Creating a process from a recently created file

DNS request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

entropy expired-cert installer invalid-signature masquerade microsoft_visual_cc overlay overlay packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/680f23fba8d43a4dd61214fb/reports/c2fb8a15-aa3a-411c-b2d7-9fbd83e07d26/overview

Verdict:

Malicious

Labled as:

Infostealer/LummaC2

Link:

https://www.hybrid-analysis.com/sample/a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/da1f8559-d0c4-46c6-8a3a-e394797a53e4

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1675994

Signature

Drops PE files with a suspicious file extension

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Score:

91%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e/

Threat name:

Win32.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-04-28 06:41:36 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uoarevzdgd6eggbayde74aogodsm7bie5xv7rvhbmmzjtxgbjvpa._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

22ed924f01afc947618c29365ef37d09a8cb5a195bd7413b5902906be43b15fb

LummaStealer

34b129b82df5d38841dc9978746790673f32273b07922c74326e0752a592a579

LummaStealer

8972f78a13ce283e5e66aa5fda7757883cee93bc9002c456505c1dcfcfbb9204

LummaStealer

a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e

LummaStealer

dea66ed67e46d3d36c95a7ebb9bd67f087a7e8b91fea959ce60c5415f805a9e9

LummaStealer

error

LummaStealer

+ 51 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/250428-hh6mfsv1cw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates processes with tasklist

Checks computer location settings

Executes dropped EXE

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://medimado.run/adodosp
https://kmetalsyo.digital/opsa
https://ironloxp.live/aksdd
https://navstarx.shop/FoaJSi
https://starcloc.bet/GOksAo
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://spacedbv.world/EKdlsk
https://zvgalxnetb.today/GsuIAo

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b366fc1a-dc5a-40e7-952b-feaad455cab6

Unpacked files

SH256 hash:

a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e

MD5 hash:

e50edd7f8b7dfc55b076079ad134eafc

SHA1 hash:

125ad706b226eba77a7a8addb21a7fd09d4ce172

Link:

https://www.unpac.me/results/5b891781-caf4-4512-af4b-6eb0835481cf/

SH256 hash:

deb4c4e83e1adb2260878aa31059f751f48e2e433142a199b616128efba1ad0d

MD5 hash:

8b1414937e70e3ad5cfacc424dc701ac

SHA1 hash:

930bd7d902ec5093aa3639f8f6064592f744f59e

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/5b891781-caf4-4512-af4b-6eb0835481cf/

Parent samples :

b57d78d93f74f7ae840ab03d3fda4f22a24ad35afcf9a53128cf82a92a67a085
06fc3e8f951fa3855d4056ea043a8de4d24b78df32f4423402305aa516fd56ff
659f55fe8c0a69b0f6c6440a777b409af34a8206613f7ed31b2b26cd821da339
fe4289d0e93af2b2bd4103c208c7887dfa2e776bc128ba00c8f5626dd386d689
5df0fcaba956997a24d19d6a56e95fb66f63e557627f461105e73e2baeae8e01
a6f505950424c626a2e800ee4d5b50de2e091d6b1f4f8ceeedc0e2e4af6aa6c0
d28fb0737213a89d3afc456a8735eeea48209d4d5ef31f8ec71a2c1796c660a3
befd287cf0e7ea186b496d2db1351ae25d279fa362babe0e0c0a00cb03287111
27a6c8ff6577be009fc1ad64de7c0856cb65407ee79b7fe1a48db58d3fccbc07
a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e
87b22dc6e19d8ae5d0a41560d6db0b3d7ae69a6e6a147fb5114b30ddf7710ace
f4d96aca90e5218b27a7d4a539d8ff5a16a6c4b94900bf1044c39254d51174fb
4e06f5dabc7a98dda7645f288f14ad415ad3791cd326940f08361aa1b84ca5ae
ec7755e923c5d31f0d3cd051a8d5fb52e4789d3a96ccd05210d38dea87221824
7ea240b6e590bb8cf4319ddc27b2ac6491ce0802b0cbb07e58bbad99f72e28d3
e285e972bd8877e3a8a5ac1cf4c7034c80c64866310e67131ab76655bbb69ee6
9137185e8f72c20aa75a54554a30ba0f8ab15696e57d4abad6d566df83dd9e89
9eefea2c305ae67db405c3fc3edb461259a9c0ec78b6cf156d084cd5b8eefc71
1f9869d28c20e90e919a1b739f83e96eac0b6d35f0fcdea932150e5fabb5c011
c82c126a95e90e070dc919b5bd4962af4dfb340b8d6f6e83bda42d63bc94eadd
1229329f146db6c61927e88dd7cb1cf4479352bc500f0a44a36d53916d82ee75

Malware family:

CypherIt

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a38112572330/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.44

Link:

https://yomi.yoroi.company/submissions/a38112572330fc431820c0c9fe01c670e4cf8504edebf8d4e1633299dcc14d5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/4651/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW KERNEL32.dll::OpenProcess KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDiskFreeSpaceW KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::GetWindowsDirectoryW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::OpenClipboard USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample