MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3a416dc21ac6a66f0e7d9c2516d934608a58bb8f07f63b3a593bcde84bf4745. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e3a416dc21ac6a66f0e7d9c2516d934608a58bb8f07f63b3a593bcde84bf4745
SHA3-384 hash:	e1bd5d8d14793e3c12a30e0ea8a332ca7d731a35d4443cb0d98591b2d519a7f0959395473dafb7d3f84ec3a984cf7fd9
SHA1 hash:	1d27cc90b2763fa033b8f6545955b2eab2689e72
MD5 hash:	15804a845a4d3f3b35533170c560a4ea
humanhash:	aspen-uncle-september-july
File name:	92.255.57_2.112.ps1
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	518'016 bytes
First seen:	2025-01-17 07:32:11 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12288:eFwo8XkxJT75LlXBtIiR8+BYYLIaooLdrq:2B9ttLooZ2
TLSH	T146B46D3201037C6F3B9A2ECEA4006EC10C5C3997B618D554AE899276B1FA53B9F5D9FC
Magika	powershell
Reporter	JAMESWT_WT
Tags:	92-255-57-112 booking LummaStealer ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

123

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PowerShell.Obfus-9.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678a07b2aa9c8e7858df1cb6

Tags:

keylog virus spawn

Hybrid Analysis Trojan[Dropper]/Agent.a

Verdict:

Malicious

Labled as:

Trojan[Dropper]/Agent.a

Link:

https://www.hybrid-analysis.com/sample/e3a416dc21ac6a66f0e7d9c2516d934608a58bb8f07f63b3a593bcde84bf4745

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox LummaC

Result

Threat name:

LummaC

Alert

Create hunting rule

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1593449

Signature

AI detected suspicious sample

LummaC encrypted strings found

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e3a416dc21ac6a66f0e7d9c2516d934608a58bb8f07f63b3a593bcde84bf4745

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e3a416dc21ac6a66f0e7d9c2516d934608a58bb8f07f63b3a593bcde84bf4745/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.LummaSteal

Threat name:

Script-PowerShell.Trojan.LummaSteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-17 07:30:21 UTC

File Type:

Text

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4osbnxbbvrvgn4hh3hbfc3mtiyeklc5y6b7whm5fso6n5bf7i5cq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/250117-jdhv9sxmhj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.