MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7
SHA3-384 hash: f838c9824c44792c17d66b3ee90d98d05c8b85cf95268a5138146c9c8e7c337ab324e6fa9b42a6f46c4c7fb583b0dcf0
SHA1 hash: b3ba9d91b6bd6913778f7db15df8def9ff2884d7
MD5 hash: f8836b019ee406add7c56f0f05a8f11b
humanhash: floor-double-arizona-ohio
File name:f8836b019ee406add7c56f0f05a8f11b.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'791'488 bytes
First seen:2025-08-21 13:12:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:Cz5mAoYcdABCL9r3sYXKfr4v5yx9g2xx2d0jdMX0:WWNAYc2MMvEX7xxm
Threatray 372 similar samples on MalwareBazaar
TLSH T1A185332E64608337CB18183655B76D0779397B0A2D5FA2969E03DA9F4C0CE3B519B8F8
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
_1a3a2be484d8f6e4a3458ef3c259f13497fc5c10062458c6b2c4373005a3d7fe.exe
Verdict:
Malicious activity
Analysis date:
2025-08-20 13:29:10 UTC
Tags:
gcleaner loader lumma stealer auto telegram autoit redline amadey botnet themida auto-reg auto-startup arch-exec rdp
Link:
https://app.any.run/tasks/971ad56b-c04d-4cf2-b66c-e1e1b7d2b888

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lumma
Create hunting rule
Link:
https://www.capesandbox.com/analysis/22790/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a71b7fc2f5296a1a288aca
Tags:
phishing virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
DNS request
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68a71b964a87ed796766ee0f/reports/1a95827e-1f70-4776-a1be-e3b55cff01e8/overview
Verdict:
Malicious
Labled as:
Symmi.Generic
Link:
https://www.hybrid-analysis.com/sample/a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a9fbe228-f41d-489e-8173-2e21797a728d
Result
Threat name:
LummaC Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1762027
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1762027 Sample: 7f7UOPPqlg.exe Startdate: 21/08/2025 Architecture: WINDOWS Score: 100 30 cursilibim.ru 2->30 50 Found malware configuration 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 5 other signatures 2->56 8 7f7UOPPqlg.exe 2->8         started        signatures3 process4 dnsIp5 46 cursilibim.ru 144.172.106.140, 443, 49716, 49781 PONYNETUS United States 8->46 58 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->58 60 Query firmware table information (likely to detect VMs) 8->60 62 Tries to detect sandboxes and other dynamic analysis tools (window names) 8->62 64 8 other signatures 8->64 12 chrome.exe 8->12         started        15 chrome.exe 8->15         started        17 chrome.exe 8->17         started        19 chrome.exe 8->19         started        signatures6 process7 dnsIp8 48 192.168.2.4, 138, 443, 49711 unknown unknown 12->48 21 chrome.exe 12->21         started        24 chrome.exe 15->24         started        26 chrome.exe 17->26         started        28 chrome.exe 19->28         started        process9 dnsIp10 32 play.google.com 142.250.65.206, 443, 49740, 49741 GOOGLEUS United States 21->32 40 4 other IPs or domains 21->40 34 142.250.176.196, 443, 49748, 49751 GOOGLEUS United States 24->34 36 ogads-pa.clients6.google.com 24->36 38 142.250.65.238, 443, 49766, 49767 GOOGLEUS United States 26->38 42 2 other IPs or domains 26->42 44 3 other IPs or domains 28->44
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/f8836b019ee406add7c56f0f05a8f11b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7/
Threat name:
Win32.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-08-20 16:34:02 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
31 of 36 (86.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3khej47wr6tran24tredviks2xraw2axavpls3r5shuten5el3q._file
Verdict:
malicious
Label(s):
lummastealer
Create hunting rule
Similar samples:
102c57004decd2173d86522467863123425f1ecccf37561fa34fca5c1de1c402
LummaStealer
15c4f381e82e4d4d24ddd1f3ca33cf16678933534da2e5c27f67ec7ece8b7509
LummaStealer
31ee08e0aad9297988beb54957c0fa5bce2d9b1d0d2c16e4932e247c73c19348
LummaStealer
6b023387ea48536d7900b1caff4c3568eb8761b55e0559b5680258bf28c55eec
LummaStealer
7fcf599838680e41a18f0790c454f3b96b59d9c65878268bb137d2a520ac4d6a
LummaStealer
8cd2c50d76ca6672c8f99a66343af62f3a41c35a141f478f55044198ba8147c9
LummaStealer
cb1ee7fa3edcc9795877868ad56cf32b9d6c3d95ea59d348e55c2b5caf87a180
LummaStealer
cdb8d74735fd803936cbb3f259418fa76aa5fa7ad03f8cba3b7d310006052e61
LummaStealer
d8c44f8a58899360bf30a527082c917bae7b564db5f129f2517a5deb39ba9ff2
LummaStealer
e9b303f24082eaf87853558d2d427ad2eecc78acd538d37e1f4397d378b47c27
LummaStealer
error
LummaStealer
+ 362 additional samples on MalwareBazaar
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma defense_evasion discovery spyware stealer
Link:
https://tria.ge/reports/250821-qgvgssbr21/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Checks BIOS information in registry
Identifies Wine through registry keys
Reads user/profile data of local email clients
Modifies trusted root certificate store through registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://cursilibim.ru/zajd
https://mastwin.in/qsaz
https://tiltyufaz.ru/tlxa
https://runmgov.ru/tixd
https://semipervaz.ru/xued
https://capitalior.ru/akts
https://retrofik.ru/jgur
https://shagkeg.ru/xkzd
https://copulardi.ru/xhza
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/06c1d147-b115-4289-bf72-391137867d02
Unpacked files
SH256 hash:
a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7
MD5 hash:
f8836b019ee406add7c56f0f05a8f11b
SHA1 hash:
b3ba9d91b6bd6913778f7db15df8def9ff2884d7
Link:
https://www.unpac.me/results/657048ff-0467-41e1-b840-5dd0d005abf7/
SH256 hash:
b8e576209497464eae1198704d47b37ac871d033c5857de3a039138876da92f2
MD5 hash:
99f36c6d5684899fb7cfacccec098c14
SHA1 hash:
cd8a23ac6d57f4e41f5877416bc8bd7dda7dd196
Link:
https://www.unpac.me/results/657048ff-0467-41e1-b840-5dd0d005abf7/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a6d472279fb4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/22790/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments