MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d297499c55bfd15701916371803aec8a41682bd399ecb1ff6245e11844dfa312. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d297499c55bfd15701916371803aec8a41682bd399ecb1ff6245e11844dfa312
SHA3-384 hash:	0b3af5886ec38134731dea961cc632e311d7e9de38deb256ca537289017a4f01a4f2588d7280302047b4644ac52a0538
SHA1 hash:	77a55ab7b8ed431261637244ee251e5cb994f881
MD5 hash:	98963a6ce76bcec1e7e256b00a3fafa9
humanhash:	yankee-hot-vegan-white
File name:	𝙎𝙀𝙏𝙐𝙋.exe
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	94'371'836 bytes
First seen:	2025-07-19 16:11:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bf95d1fc1d10de18b32654b123ad5e1f (327 x LummaStealer, 65 x Rhadamanthys, 25 x Vidar)
ssdeep	24576:AzZbM0HRVsERm85sfx+RSIF1vtV5CGngHtjVgd5UIwEWuewsRxmiv88v31zYF8Pi:ARMmVskm8c+RmHtjVgPhMFAiEIlE8K
TLSH	T19F2812A0B3517F28E69F60E583D4C82D0B6BF1475B9266370EBEF18BB94153211F8B94
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	e4e4e3cb9eeab2a6 (2 x LummaStealer)
Reporter	aachum
Tags:	AutoIT CypherIT exe LummaStealer

iamaachum

https://plcbvisa.com/?=ijn&diu=66&sid=t0l => https://mega.nz/file/XcFn3AyQ#UsMzczjV_SkckYpLPkm9fOJsfIO4LeoUpp5sZaCRQkA

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

717

Origin country :

ES

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

948d9a24-a0d5-42aa-ac84-ad8251b89885

Verdict:

Malicious activity

Analysis date:

2025-07-19 16:14:03 UTC

Tags:

autoit telegram lumma stealer

Link:

https://app.any.run/tasks/948d9a24-a0d5-42aa-ac84-ad8251b89885

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=687bc3e184b37dd61eef9fb4

Tags:

autoit emotet

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug blackhole installer microsoft_visual_cc overlay overlay packed

Link:

https://www.filescan.io/uploads/687bc3bc8a7d628a81b7b6c7/reports/ec60023d-d212-4a45-9b87-02ac051e8e22/overview

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1740166

Signature

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops PE files with a suspicious file extension

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Search for Antivirus process

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/d297499c55bfd15701916371803aec8a41682bd399ecb1ff6245e11844dfa312

CERT.PL MWDB

Gathering data

Neiki trojan.darkgate

Verdict:

Malicious

Threat:

trojan.darkgate

Link:

https://tip.neiki.dev/file/d297499c55bfd15701916371803aec8a41682bd399ecb1ff6245e11844dfa312

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-07-19 02:44:45 UTC

File Type:

PE (Exe)

Extracted files:

20

AV detection:

10 of 24 (41.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2kluthcvx7ivoamrmnyyaoxmrjawqk6tthwld73cixqrqrg7umja._file

Hatching Triage lumma

Result

Malware family:

lumma

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma defense_evasion discovery spyware stealer trojan

Link:

https://tria.ge/reports/250719-tm918axsds/

Behaviour

Modifies system certificate store

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Drops file in Windows directory

Enumerates processes with tasklist

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://t.me/dvsaedv21vasevas
https://prezud.top/xkaj
https://thoqp.lat/zidw
https://unxyng.top/zpld
https://trbxlj.top/atiw
https://cooawbi.top/dpla
https://ourkbpw.top/aoti
https://gehkmx.top/xkaj
https://sacrp.top/amnt
https://dktnd.top/xuqi

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9bd248ff-0954-41b5-9cb1-93012034d158

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.