MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef41e748e0dc42f973d42f6db4e78389d763ee132281c88da09f09ac30f87a0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ef41e748e0dc42f973d42f6db4e78389d763ee132281c88da09f09ac30f87a0c
SHA3-384 hash:	53d425d9b2c44952ac0554daf03bf4ffc56bc3f2e2d96dcc24aa82f0d97ddacbf730cad364fec26f7790869285c58c3a
SHA1 hash:	c3b98d6ef35175eebdfc20ae5132d60114f0717a
MD5 hash:	211a9dc1cf5e1b37e8fa76131bcef49d
humanhash:	massachusetts-romeo-pip-ceiling
File name:	--FulL_File_SetUp-2025_PassW0rd@.zip
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	10'424'010 bytes
First seen:	2024-09-05 21:39:03 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:DBy2BYbK19iUTEVEZSBrOJaTT1fOysyTotADeSWPdAV+aqe3w4lTBl7+g6M3T8GF:jWbK7i6oEZScetsyTotWeSWQ+eAuBlaG
TLSH	T1E2B63328F40A0BD1D5FC1C5DD1E1BE1742949E9446C7183817F4EC8238FD6E61AAFBAA
Magika	zip
Reporter	kddx0178318
Tags:	lumma LummaStealer zip

kddx0178318

https://www.hienzo[.]com/ >
https://www.mediafire[.]com/file/vvcl020pcvqwced/--FulL_File_SetUp-2025_PassW0rd@.zip/file

ZIP >Setup.exe > BitLockerToGo.exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

156

Origin country :

ES

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	File_PAssC0de$
File size:	274'456 bytes
SHA256 hash:	85d978fd7bc983d852c24827ebdc909c81aacd7d8d8d09dc6f44427f8a6fec72
MD5 hash:	6d31fad6dd24a1384a579fe2527cdd42
MIME type:	text/plain
Signature	LummaStealer

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66da258ef3d7ccf99f901be9

Tags:

n/a

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ef41e748e0dc42f973d42f6db4e78389d763ee132281c88da09f09ac30f87a0c

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/ef41e748e0dc42f973d42f6db4e78389d763ee132281c88da09f09ac30f87a0c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ef41e748e0dc42f973d42f6db4e78389d763ee132281c88da09f09ac30f87a0c/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=55a6osha3rbps46uf5w3jz4drhlwh3qteka4rdnat4e2ymhypiga._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Lumma

Threat name:

Lumma

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ef41e748e0dc42f973d42f6db4e78389d763ee132281c88da09f09ac30f87a0c

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

zip ef41e748e0dc42f973d42f6db4e78389d763ee132281c88da09f09ac30f87a0c

(this sample)

LummaStealer

exe 293dd7a2a5722f7c1ccad4206ddcff3af51d8b03cc434ba5be8c4e9b104c292e

any.run

https://app.any.run/tasks/4be627a5-07f9-44ac-932e-12536f6fadf7/

  

Dropping

SHA256 293dd7a2a5722f7c1ccad4206ddcff3af51d8b03cc434ba5be8c4e9b104c292e

  

Delivery method

Distributed via web download

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

kddx01 commented on 2024-09-05 21:40:42 UTC

https://www.virustotal.com/gui/file/293dd7a2a5722f7c1ccad4206ddcff3af51d8b03cc434ba5be8c4e9b104c292e?nocache=1
https://x.com/kddx0178318/status/1831807863137956260