MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5a5d277dce66c103161d620480b854cb49060f3d3660886b068185346433402. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	a5a5d277dce66c103161d620480b854cb49060f3d3660886b068185346433402
SHA3-384 hash:	b7d44624889217b11b7a5364c98081248d3d32fed395f49601dd3c1f3a791cf7d27c6d0eaf8cc8a7e10a8d53200a123e
SHA1 hash:	04043ef1c918ecf9f8adc5f69f49be224c56a520
MD5 hash:	fb414d74319029d9a9ba66033051aa51
humanhash:	twenty-connecticut-mirror-nuts
File name:	random.exe
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'234'432 bytes
First seen:	2025-06-05 06:25:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f9f160ce0f0c454ba71d5ad40cc375c9 (24 x LummaStealer, 1 x Vidar)
ssdeep	24576:nSxGdss5tPmW4JSjfJBxYDBGd7EZVgL9UBj0gOS+zLUvbP:wGdRyWiSdvsBGhEZVGWNOovbP
Threatray	192 similar samples on MalwareBazaar
TLSH	T144457D299142E1C6FC6A40B605B1A1A83462B733C63D2FFF8290E333AD07BD55B6975D
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

440

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

random.exe

Verdict:

Malicious activity

Analysis date:

2025-06-05 06:49:19 UTC

Tags:

lumma stealer telegram

Link:

https://app.any.run/tasks/814034c1-535b-497e-a89c-0db8d714331c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/7420/

Detection(s):

Win.Packed.Agen-10045321-0

Win.Packed.Agen-10045323-0

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68413bac07b5e8c1cfe4d26c

Tags:

virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt to an infection source

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/68413883fd02ed5e059941cb/reports/e8932abd-3810-4a49-b754-65e28251a624/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/a5a5d277dce66c103161d620480b854cb49060f3d3660886b068185346433402

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d2e6042b-b607-4561-9bf3-32df1dad0716

Result

Threat name:

LummaC Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1706904

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Writes to foreign memory regions

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a5a5d277dce66c103161d620480b854cb49060f3d3660886b068185346433402

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a5a5d277dce66c103161d620480b854cb49060f3d3660886b068185346433402/

Threat name:

Win64.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-06-04 14:57:29 UTC

File Type:

PE+ (Exe)

AV detection:

30 of 38 (78.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uws5e5644zwbamlb2yqeqc4fjs2jayht2ntarbvqnamfgrsdgqba._file

Verdict:

malicious

Label(s):

lummastealer

LummaStealer

076858a27b712af3e1e811f606e9cabb374490a5c0a983aea1000e1334179303

LummaStealer

211e989abb46301bb0bae2e358650951467febaca4a51ea73e60ca3e231e5c5d

LummaStealer

610b22833913e0be781d07739429f836fce8bdbe24088b2a9d06e530bc16ccac

LummaStealer

8a8689a5d75999f25e635fd0fc2a74785f0c79ebc15de4f340b4fdf4f37ff894

LummaStealer

e4879877a8f18a7fe1e814755edc0a039f62517df4dbd076ea4343042000742d

LummaStealer

error

LummaStealer

fafec872e4e681079981bee089865af4303c4e359b311b47c127e02f3faaa341

LummaStealer

+ 182 additional samples on MalwareBazaar

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery stealer

Link:

https://tria.ge/reports/250605-g7f8esbl7s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://https://t.me/clanroma/api
https://screhwc.live/atoi
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://tinklertjp.bet/nzaf
https://diecam.top/laur/api
https://citellcagt.top/gjtu
https://witchdbhy.run/pzal

Verdict:

Malicious

Tags:

Win.Packed.Agen-10045321-0

YARA:

n/a

Link:

https://app.threat.zone/submission/3f4888e8-6680-4356-996d-4c8baa5363c9

Unpacked files

SH256 hash:

a5a5d277dce66c103161d620480b854cb49060f3d3660886b068185346433402

MD5 hash:

fb414d74319029d9a9ba66033051aa51

SHA1 hash:

04043ef1c918ecf9f8adc5f69f49be224c56a520

Link:

https://www.unpac.me/results/5d53a8c8-34f7-4c2e-9d10-c624701e2b85/

Malware family:

Lumma

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a5a5d277dce6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a5a5d277dce66c103161d620480b854cb49060f3d3660886b068185346433402

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)