MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LummaStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab
SHA3-384 hash: 3a720147e4f4209bab769bed06f90a330685cdd34c2b34a7d98b7fcde4e0d1e24d56e6517f7e83e70df45a49707a240d
SHA1 hash: 6d96b9db126fd2f30974c0b2a75867ee96558b91
MD5 hash: 7a85770069e9aa7540468612454c3df2
humanhash: romeo-wyoming-alaska-eleven
File name:ValLoader.exe
Download: download sample
Signature LummaStealer
Create hunting rule
File size:1'379'328 bytes
First seen:2025-08-23 18:07:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 534d1f4899e357d483815235b1dd8f02 (8 x LummaStealer, 1 x CoinMiner, 1 x DonutLoader)
ssdeep 24576:XOnbhY0n7HayFuc2mm3soSwXrbIPgYHnnekxdMRna3tCI:em0eX/Agr6ekxdMBwn
Threatray 243 similar samples on MalwareBazaar
TLSH T18455E11DA93950EAFCE300B16B1A9511F422BD378F3465DB42E48B613917EFD0A3E366
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter AntiSkidding
Tags:exe fake-cheat LummaStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ValLoader.exe
Verdict:
Malicious activity
Analysis date:
2025-08-23 18:09:24 UTC
Tags:
anti-evasion stealer
Link:
https://app.any.run/tasks/d5a7a5ba-6022-4144-af10-c1d0b2de47ec

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23174/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68aa03a7e9d9dbcfd96d36c7
Tags:
spoof virus krypt
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/68aa037b7137d68458395cfc/reports/66adfb42-91e6-475e-b7dd-b829138b39a0/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab
Verdict:
Unknown
File Type:
exe x64
Link:
https://opentip.kaspersky.com/ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3eb33a5b-0aad-4f36-bac0-db1e3721cc6e
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/7a85770069e9aa7540468612454c3df2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab/
Threat name:
Win64.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-08-23 18:08:46 UTC
File Type:
PE+ (Exe)
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5t36ryl3kawktzfwe5gpab53r6obrufncumm4oir3m7ham3zlcvq._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
018f9ba428f4e3360bb6ee7c42f5f475bda12ae71a430d603a4a5e8ea94fdcf9
LummaStealer
3264e99fa7dfab9796a7f0622696e570806299493782c507ee80e27a2d54d855
LummaStealer
47767a97c828554f2092c5e2fc505e103ff42114cd75071fd69e16111037a83a
LummaStealer
6b5266685f3fe4ca9e4d7cf5b16b26fcae1c215eb9933eb471240d4daaecdaf5
LummaStealer
81d322befe2fb9594401df99bba21b530b75feb0a505a64c67839d93df9fac50
LummaStealer
925a447b319c05bc4ebe88b3a4404a84351e01026ef4de8d65bed475c9859be9
LummaStealer
a5abb6a6dcbd0e5a11bc7788b06ed3f9ec916ab742da913056161a0baaea09a5
LummaStealer
abf052189d7c4ecb828806ff3e559de0e4bd0ba5e69c01575a8f8217bf2868d6
LummaStealer
c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7
LummaStealer
daa1e8c37f131efe55995260e3772db5bfe8d3d5c5c96d2adc7a55492aab0bae
LummaStealer
error
LummaStealer
+ 233 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/250823-wqsbpaxrz6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8c4d8336-4a3b-44bf-868d-da60bb105eac
Unpacked files
SH256 hash:
ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab
MD5 hash:
7a85770069e9aa7540468612454c3df2
SHA1 hash:
6d96b9db126fd2f30974c0b2a75867ee96558b91
Link:
https://www.unpac.me/results/056dbdfd-c40a-455f-b093-416c7214e67f/
Malware family:
Rhadamanthys
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ecf7e8e17b50/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/23174/

Comments