MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f70fc399eacf8b2407f008e78909d5836239de2e8818e99f42f34d4d7bc9673d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LummaStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	f70fc399eacf8b2407f008e78909d5836239de2e8818e99f42f34d4d7bc9673d
SHA3-384 hash:	9c62ccd33c998d6a4c0fb0fca32de6b80e22eecb3f31063a5786664eaae8bc0854f3a89f632cede62f4b962f46cb9e4e
SHA1 hash:	1235c024a40dcdb10d2121902d8cdbe91b88040b
MD5 hash:	78b28a4e8e58c6d8c791f141d1b0793d
humanhash:	cola-solar-fourteen-happy
File name:	set𝓤p_9087_𝓓𝓸𝔀𝓷𝓵𝓪𝓸𝓭_𝟞𝟜𝕓𝕚!_𝕃𝔞т𝒆Ŝ𝓣.7z
Download:	download sample
Signature	LummaStealer Create hunting rule
File size:	1'335'682 bytes
First seen:	2025-04-11 14:35:22 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 9087
ssdeep	24576:mp8nulp6EGZ5hqbbPnE90X/yRTfyjaEKqdp8yc4pX5zwEyg44t:mp8MpJGsXPnE90PyVyjaInTF5zXy/4t
TLSH	T14C5533447A066B8F74B11EDD0369A1C3A99ACFAD077F0F01A847F1AF6E6C05A98F5601
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z AutoIT file-pumped LummaStealer pw-9087

iamaachum

https://sikoip.cfd/download?filedrive=bEUotZ4yi8pJPxaXshzw19fQcA0MljRe26LNCdIFvWuBKDkT7Gn3rHmSV5gYqO=&ouQ=pC3oF4amRY6vcbNEDutI2PJ => https://mega.nz/file/JBY1TCQY#UduYvC_TipMh-WegKTNN8fmiWbtoBHyTYvxJko1VXvM

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: 9087

This file archive contains 1 file(s), sorted by their relevance:

File name:	Setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	734'016'363 bytes
SHA256 hash:	cdec034ca99c00a6a37f3232d842255c41313ced005d41f74a84740bdaa10684
MD5 hash:	be25767340eb8fae779632a31fec9e3f
De-pumped file size:	158'720 bytes (Vs. original size of 734'016'363 bytes)
De-pumped SHA256 hash:	a127a856928ecc1e7f98905911b08d198f06e4fb94a8ec8cf88ae1f46e2ca92c
De-pumped MD5 hash:	6ce00fafe7227dd6b596a83d4b9614d3
MIME type:	application/x-dosexec
Signature	LummaStealer

Vendor Threat Intelligence

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f93142d6e7c3effad01aa1

Tags:

autoit emotet lien

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f70fc399eacf8b2407f008e78909d5836239de2e8818e99f42f34d4d7bc9673d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f70fc399eacf8b2407f008e78909d5836239de2e8818e99f42f34d4d7bc9673d/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=64h4hgpkz6fsib7qbdtyscovqnrdtxroramoth2c6ngu266jm46q._file

Result

Malware family:

lumma

Score:

10/10

Tags:

family:lumma discovery spyware stealer

Link:

https://tria.ge/reports/250411-xcyrzsxlx5/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates processes with tasklist

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Lumma Stealer, LummaC

Lumma family

Malware Config

C2 Extraction:

https://vqaliantheart.live/oniz
https://soursopsf.run/gsoiao
https://changeaie.top/geps
https://easyupgw.live/eosz
https://liftally.top/xasj
https://upmodini.digital/gokk
https://osalaccgfa.top/gsooz
https://zestmodp.top/zeda
https://xcelmodo.run/nahd

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)