MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ff07f07ed8d9ebf869603100b975c0e172d66e62973150e3e4b918e2faacf4b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
LummaStealer
Vendor detections: 17
| SHA256 hash: | ff07f07ed8d9ebf869603100b975c0e172d66e62973150e3e4b918e2faacf4b1 |
|---|---|
| SHA3-384 hash: | ef98a02f0011f3b74783260dd758ae127ed7091a7e03350cddb2884425165a42a0a8590c5fc14e5153c77d0d0cc30e60 |
| SHA1 hash: | 76c69c08279d2fbed4a97a116284836c164f9a8b |
| MD5 hash: | dba9d78f396f2359f3a3058ffead3b85 |
| humanhash: | indigo-stream-rugby-purple |
| File name: | T0QdO0l.exe |
| Download: | download sample |
| Signature | LummaStealer |
| File size: | 1'400'832 bytes |
| First seen: | 2025-03-07 15:55:53 UTC |
| Last seen: | 2025-03-07 17:07:08 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:M5+bX2G7cFEXcoFRTytjZEK/yqTiihsf9KjauKyRGYtGQB+9OUI/PvBvK1:cIGqcGcoFRTM/yqmihs1KjauKyRGYfBR |
| Threatray | 2'453 similar samples on MalwareBazaar |
| TLSH | T137550117778AA9B1C1D26776C8F75500C3B4FA81E663D60E7D8A235B4D43FAE987020B |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  aachum |
| Tags: | exe LummaStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
401
Origin country :
ESVendor Threat Intelligence
Malware family:
amadey
ID:
1
File name:
44c657fa4e956fb944c42dc881d49a4a719767a2b92d02729e7415a6c6a14192
Verdict:
Malicious activity
Analysis date:
2025-03-05 19:40:40 UTC
Tags:
opendir loader amadey botnet stealer lumma exfiltration themida rdp
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
99.9%
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %AppData% directory
Launching a process
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
net_reactor obfuscated packed packed packer_detected stealer
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
LummaC Stealer
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
C2 URLs / IPs found in malware configuration
Drops VBS files to the startup folder
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected LummaC Stealer
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Exploit.Generic
Status:
Malicious
First seen:
2025-03-05 22:55:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
18 of 24 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
lummastealer
Similar samples:
+ 2'443 additional samples on MalwareBazaar
Result
Malware family:
lumma
Score:
10/10
Tags:
family:lumma discovery spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Browser Information Discovery
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Drops startup file
Lumma Stealer, LummaC
Lumma family
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
https://techspherxe.top/api
https://explorebieology.run/api
https://agroecologyguide.digital/api
https://moderzysics.top/api
https://seedsxouts.shop/api
https://codxefusion.top/api
https://farfinable.top/api
https://cropcircleforum.today/api
https://explorebieology.run/api
https://agroecologyguide.digital/api
https://moderzysics.top/api
https://seedsxouts.shop/api
https://codxefusion.top/api
https://farfinable.top/api
https://cropcircleforum.today/api
Verdict:
Malicious
Tags:
c2 stealer lumma_stealer lumma
YARA:
n/a
Unpacked files
SH256 hash:
ff07f07ed8d9ebf869603100b975c0e172d66e62973150e3e4b918e2faacf4b1
MD5 hash:
dba9d78f396f2359f3a3058ffead3b85
SHA1 hash:
76c69c08279d2fbed4a97a116284836c164f9a8b
SH256 hash:
22577a90237ef86e4b30994983f8c7ae9431d815244cbcc924386540ae44f00a
MD5 hash:
f52c57825265c0ce331d92b1eb836569
SHA1 hash:
f945ad00eae432a8419d2d8811a6e7298b6c7dd1
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
SH256 hash:
5477325057eaf7b9f30812e2a4de207c1f957d0bbad15b470912292c19653c05
MD5 hash:
cdc8e29e07b36a820928f0cbf9217119
SHA1 hash:
df75dc18a41081861192130d5c9345a49e67d9ad
SH256 hash:
621cc65dc6ba6ab406a37f5bab3e31781f2d96a984df064f9219d0d74f3f0704
MD5 hash:
8bbce8d505bee004be2491c97ac12b83
SHA1 hash:
f27b5fc55f6fa8770b33dd152bf6b30d485678ac
Detections:
win_lumma_auto
LummaStealer
Malware family:
Lumma
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Lumma |
|---|---|
| Author: | kevoreilly |
| Description: | Lumma Payload |
| Rule name: | Lumma_Stealer_Detection |
|---|---|
| Author: | ashizZz |
| Description: | Detects a specific Lumma Stealer malware sample using unique strings and behaviors |
| Reference: | https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/ |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | Windows_Trojan_Lumma_4ad749b0 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_lumma_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.lumma. |
| Rule name: | win_lumma_generic |
|---|---|
| Author: | dubfib |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Dropped by
Amadey
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.