MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8599f3092251abe3536ea6bebbca4cd0b0630e8f6532ba409c86bd3f38b50c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments 1

SHA256 hash:	b8599f3092251abe3536ea6bebbca4cd0b0630e8f6532ba409c86bd3f38b50c0
SHA3-384 hash:	029354ffc334eb9d6473ff01b2f770ef2b7548f9d116b844862021c1a33811d176ed23d22c05e296af990b01abd85cd8
SHA1 hash:	f30ada634feb0506410c6f85996d0a78e20681db
MD5 hash:	e4933fe3be95e395bc4ce92d88b390bc
humanhash:	high-romeo-zulu-monkey
File name:	firsthookup.hta
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	8'294'895 bytes
First seen:	2025-03-30 18:27:59 UTC
Last seen:	2025-03-31 16:30:19 UTC
File type:	hta
MIME type:	audio/mpeg
ssdeep	196608:R5q/CVRXmKWpRM2DKS4VS5I8x3DauZDSilw3mcaw3:3qaVRXBWpRM2DgVSpauZDSiqWcak
TLSH	T19C86234A567445ADF0532C7DADEB1184D945AC283A31C0D8CA3DEFA46437C46EFEAF0A
TrID	62.5% (.MP3) LAME encoded MP3 audio (ID3 v2.x tag) (5000/1/1) 37.5% (.MP3) MP3 audio (ID3 v2.x tag) (3000/1)
Magika	mp3
Reporter	Chamindu_X
Tags:	ClickFix hta lumma LummaStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e99540855e5ec5240a68b1

Tags:

obfuscate xtreme shell

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/b8599f3092251abe3536ea6bebbca4cd0b0630e8f6532ba409c86bd3f38b50c0/results/dashboard

Payload URLs

URL

File name

https://www.jamendo.com

HTA File

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67e99394631830704a8b7556/reports/e994a552-c3c0-446d-baf9-a7247e23ca9c/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b8599f3092251abe3536ea6bebbca4cd0b0630e8f6532ba409c86bd3f38b50c0

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1652292

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b8599f3092251abe3536ea6bebbca4cd0b0630e8f6532ba409c86bd3f38b50c0/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2025-03-30 12:05:24 UTC

File Type:

Audio

AV detection:

2 of 38 (5.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xbmz6meseunl4njw5jv6xpfezufqmmhi6zjsxjajzbv5h44lkdaa._file

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250330-xkwmlaxjx8/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b8599f3092251abe3536ea6bebbca4cd0b0630e8f6532ba409c86bd3f38b50c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)