MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f69b9eef0e75577f64c39a14148f11ff83d6b4b50b6bc99b38b960c94eff7031. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f69b9eef0e75577f64c39a14148f11ff83d6b4b50b6bc99b38b960c94eff7031
SHA3-384 hash:	47df93c91e640b2aa203d54ca42d1f9ec38f0ed13231e9b61162ec337da1267c1fa049d158da3273d063aeeecffe7e92
SHA1 hash:	66ae0107faa274e8db513f01f80ddc11d80dcf68
MD5 hash:	6333790d284e012ad9d128a8e994c213
humanhash:	freddie-helium-iowa-table
File name:	setup.exe
Download:	download sample
Signature	LummaStealer Alert Create hunting rule
File size:	99'614'712 bytes
First seen:	2025-08-19 21:56:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b729b61eb1515fcf7b3e511e4e66258b (70 x LummaStealer, 16 x Rhadamanthys, 8 x Adware.Generic)
ssdeep	24576:FVDMrc90taISS1AMdcgnPhRZU1xeXugfQt7cHdIzC/RQ1IlucKHj51X2D:Fac96LSBMeOXEgg7RsS1OTKHj51X6
Threatray	497 similar samples on MalwareBazaar
TLSH	T149281243CB5452C7D01EB1171AD990CF6131DA7BE3A50A3A0AD6B24AC5D2B80DAF377B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	73e1b2b67060f828 (2 x LummaStealer)
Reporter	aachum
Tags:	AutoIT CypherIT exe LummaStealer

iamaachum

https://bghytf.icu/?file=sKcfZSgUBEYdu9Mh1JjL2npRaqAbOkF0&78TghswHjP14C=louLx924OspwNI1M6SPRXDU7feKbB5WiYV8ZH0cTGmqk3dy => https://mega.nz/file/PTgUyZ4K#fV48fvjQQRRuoekTM-yzYIshht7OheWLJISdlA8y4Xk

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

91

Origin country :

ES

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

setup.exe

Verdict:

Malicious activity

Analysis date:

2025-08-19 22:03:21 UTC

Tags:

lumma stealer autoit qrcode

Link:

https://app.any.run/tasks/dc92b3a8-1995-4b57-9cc0-d3bed2fddee2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a4f3778fd55a79c5294ec4

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Searching for the window

Searching for the Windows task manager window

Running batch commands

Creating a process with a hidden window

Launching cmd.exe command interpreter

Launching a process

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a process from a recently created file

DNS request

Connection attempt

Sending a custom TCP request

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug blackhole installer microsoft_visual_cc overlay overlay

Link:

https://www.filescan.io/uploads/68a4f382a4bdac9f5b9f4f0c/reports/3a04bcc2-c284-4344-a03e-7a3d14ace51c/overview

Hybrid Analysis Malware_48.7

Verdict:

Suspicious

Labled as:

Malware_48.7

Link:

https://www.hybrid-analysis.com/sample/f69b9eef0e75577f64c39a14148f11ff83d6b4b50b6bc99b38b960c94eff7031

Joe Sandbox LummaC Stealer

Result

Threat name:

LummaC Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1760624

Signature

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Detected CypherIt Packer

Drops PE files with a suspicious file extension

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Search for Antivirus process

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Yara detected LummaC Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/f69b9eef0e75577f64c39a14148f11ff83d6b4b50b6bc99b38b960c94eff7031

CERT.PL MWDB

Gathering data

Neiki Family.LUMMA

Verdict:

Malicious

Threat:

Family.LUMMA

Link:

https://tip.neiki.dev/file/f69b9eef0e75577f64c39a14148f11ff83d6b4b50b6bc99b38b960c94eff7031

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-08-19 22:04:47 UTC

File Type:

PE (Exe)

Extracted files:

17

AV detection:

11 of 24 (45.83%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=62nz53yoovlx6zgdtikbjdyr76b5nnfvbnv4tgzyxfqmstx7oayq._file

Threatray unc_loader_058

Verdict:

malicious

Label(s):

unc_loader_058

Alert

Create hunting rule

Similar samples:

1695039099cdff9bf78f8314bf8b64788b020b5547993ec2c9ec524ad2a4a497

LummaStealer

226a1ff2b5c820419ece3b76bf6a6c96e1ce4e6138b5688971660d1d3f3d5df5

LummaStealer

3db0bd4805036701a3f31c61a988e14c319638f11a7456d5a6d0e78e6ca793c6

LummaStealer

435f92f2e714f302ec2a0bdde479a11b9d1759e83ea4fbacc93aad5f2e0626b9

LummaStealer

a94ae28be6a45b53d3a1b07798fbf87238bbbefc22044e04f503f666866be461

LummaStealer

c432a19149f7904f2011395298a29b93fdc456b18e3df8691d16bae435297003

LummaStealer

da289d2f2f50cbef9f9d6034e1a32e331c1b309f49c2e1e5029ec154e721af4c

LummaStealer

error

LummaStealer

f0f594b7745386bc9d295183742da8a2425b728227a31ec1668a0001f8c0ed65

LummaStealer

f69b9eef0e75577f64c39a14148f11ff83d6b4b50b6bc99b38b960c94eff7031

LummaStealer

+ 487 additional samples on MalwareBazaar

Hatching Triage lumma

Result

Malware family:

lumma

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma defense_evasion discovery spyware stealer

Link:

https://tria.ge/reports/250819-1vlrxsxrx4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Drops file in Windows directory

Enumerates processes with tasklist

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Modifies trusted root certificate store through registry

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://semipervaz.ru/xued
https://mastwin.in/qsaz
https://tiltyufaz.ru/tlxa
https://runmgov.ru/tixd
https://capitalior.ru/akts
https://retrofik.ru/jgur
https://shagkeg.ru/xkzd
https://copulardi.ru/xhza

VMRay CypherIt

Malware family:

CypherIt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f69b9eef0e75/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f69b9eef0e75577f64c39a14148f11ff83d6b4b50b6bc99b38b960c94eff7031