MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbe9afc04165fc7ce7c1d18b75929a452a30486f43405e206baa0fb05e94daa1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 5


Intelligence 5 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbe9afc04165fc7ce7c1d18b75929a452a30486f43405e206baa0fb05e94daa1
SHA3-384 hash: fe66ec2c84e5a8caf8c8f3705f3a869171d7e6bf27d49e90d9089d9cef7ac73c7160adf2030ab2c58a5d6bb57128ac98
SHA1 hash: 36886c25fb71c80a253f7737273c4f2616e30368
MD5 hash: 4e858ca1bd97da6fae2dc337e9381174
humanhash: network-fillet-equal-south
File name:activate.rar
Download: download sample
Signature LummaStealer
Create hunting rule
File size:10'394'943 bytes
First seen:2025-04-13 07:47:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
Note:This file is a password protected archive. The password is: infected
ssdeep 196608:nKgfuVubj5BcA8qK0BnJX4QPos82MXvj9Zqm5Ej/Tl1E:nKLMb1BcA8j0tJXDPos8tX7KRjTla
TLSH T178A633E41C80E62E83D8B609369EE9559513DC0FAD37DF13CF8E1458D2F71A463B829A
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter Syndikalist
Tags:file-pumped lumma LummaStealer rar


Avatar
Syndikalist
Fake kmspico campaign, sample obtained via: kmspico[.]biz

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
NZ NZ
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:activate.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:694'479'469 bytes
SHA256 hash: 3212d66b56683e0d962b803632f8f8a16d8d7a0211e0d02d8dfa1dfc11aa6a6e
MD5 hash: 2bd0cf677057e90ac12aeafdd256eab9
De-pumped file size:27'667'456 bytes (Vs. original size of 694'479'469 bytes)
De-pumped SHA256 hash: 870a29a9b9eab5de45354a1b1c621b833e41ded4fbba41432d7d5ecb63b35a42
De-pumped MD5 hash: 045da589d63bfd00ad801c78bbeebbe6
MIME type:application/x-dosexec
Signature LummaStealer
Vendor Threat Intelligence
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67fb7709d6e7c3effad18c29
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm crypto fingerprint installer keylogger large-file mingw overlay packed
Link:
https://www.filescan.io/uploads/67fb6c3b2d430c849e164e8c/reports/38ac06a1-63f9-4c00-bdfd-34d275788fa1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/bbe9afc04165fc7ce7c1d18b75929a452a30486f43405e206baa0fb05e94daa1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbe9afc04165fc7ce7c1d18b75929a452a30486f43405e206baa0fb05e94daa1/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-13 07:48:14 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xpu27qcbmx6hzz6b2gfxleu2iuvdasdpinaf4idlvih3axuu3kqq._file
Result
Malware family:
lumma
Create hunting rule
Score:
  10/10
Tags:
family:lumma discovery spyware stealer
Link:
https://tria.ge/reports/250413-jpxhss1pv9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Browser Information Discovery
System Location Discovery: System Language Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Lumma Stealer, LummaC
Lumma family
Malware Config
C2 Extraction:
https://revitmodh.run/pzaw
https://dsoursopsf.run/gsoiao
https://changeaie.top/geps
https://easyupgw.live/eosz
https://rliftally.top/xasj
https://upmodini.digital/gokk
https://salaccgfa.top/gsooz
https://zestmodp.top/zeda
https://ixcelmodo.run/nahd
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:win_stealer_generic
Create hunting rule
Author:Reedus0
Description:Rule for detecting generic stealer malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

rar bbe9afc04165fc7ce7c1d18b75929a452a30486f43405e206baa0fb05e94daa1

(this sample)

LummaStealer

Executable exe 870a29a9b9eab5de45354a1b1c621b833e41ded4fbba41432d7d5ecb63b35a42

  
Delivery method
Distributed via web download
  
Dropping
SHA256 870a29a9b9eab5de45354a1b1c621b833e41ded4fbba41432d7d5ecb63b35a42
  
Dropping
MD5 045da589d63bfd00ad801c78bbeebbe6

Comments