84cf6bb876853f4b8bfe9d3b27baf91bb04dd29031d1724b78337a28985c676d

Classification: Malicious

84cf6bb876853f4b8bfe9d3b27baf91bb04dd29031d1724b78337a28985c676d is a malicious file sample. Reported by 3 threat sources, last seen 2026-09-02.

Detection summary

  • 56 antivirus detections
  • 2 IDS alerts
  • 4 processes observed
  • 4 contacted hosts
  • 4 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-09-25 19:30:05 2026-09-02 21:45:04 malicious-activity
Lumma Stealer ThreatFox Abuse.ch 2025-04-02 16:34:33 2025-04-04 17:29:04
Generic.Malware MalwareBazaar Abuse.ch 2024-09-23 14:05:20 2024-09-23 14:05:20 malicious-activity

Tags

win.lumma lummac2 stealer evasive infostealer

Sample information

Filenames
84cf6bb876853f4b8bfe9d3b27baf91bb04dd29031d1724b78337a28985c676d, 84cf6. Stealer.exe, file
File type
application/x-dosexec
Size
403456 bytes
MD5
64bb15a561342db08d8362ab5b83f37f
SHA-1
9fcd468bc8ebcc5dd1bf98329824bb5fc8c2b255
SHA-256
84cf6bb876853f4b8bfe9d3b27baf91bb04dd29031d1724b78337a28985c676d
First indexed
2024-09-23 15:23:13
Last updated
2026-09-02 21:45:04

Antivirus detections

EngineDetection
ALYacGen:Variant.Jalapeno.18453
APEXMalicious
AVGWin32:PWSX-gen [Trj]
AhnLab-V3Trojan/Win.Vidar.C5672959
AlibabaTrojan:MSIL/LummaStealer.73d8dd55
ArcabitTrojan.Jalapeno.D4815
AvastWin32:PWSX-gen [Trj]
AviraTR/AD.Stealc.fxmlp
BitDefenderGen:Variant.Jalapeno.18453
CAT-QuickHealTrojan.Ghanarava.173228449883f37f
CTXexe.trojan.msil
ClamAVWin.Packed.Pwsx-10035189-0
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebTrojan.DownLoader47.39723
ESET-NOD32a variant of MSIL/GenKryptik.HCGG
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Jalapeno.18453 (B)
F-SecureTrojan.TR/AD.Stealc.fxmlp
FireEyeGeneric.mg.64bb15a561342db0
FortinetMSIL/Kryptik.AMFU!tr
GDataGen:Variant.Jalapeno.18453
GoogleDetected
GridinsoftTrojan.Win32.Packed.dd!ni
IkarusTrojan.MSIL.Krypt
K7AntiVirusTrojan ( 700000121 )
K7GWTrojan ( 700000121 )
KasperskyHEUR:Trojan.MSIL.Stelpak.gen
KingsoftMSIL.Trojan.Crypt.gen
LionicTrojan.Win32.LummaStealer.4!c
MalwarebytesTrojan.Crypt
MaxSecureTrojan.Malware.274051615.susgen
McAfeeArtemis!64BB15A56134
McAfeeDti!84CF6BB87685
MicroWorld-eScanGen:Variant.Jalapeno.18453
MicrosoftTrojan:MSIL/LummaStealer.GPD!MTB
NANO-AntivirusTrojan.Win32.Stealc.ksgcko
Paloaltogeneric.ml
PandaTrj/Chgt.AD
RisingMalware.Obfus/[email protected] (RDM.MSIL2:FBWUdfcTUjq5e9CeJFacCQ)
SangforSuspicious.Win32.Save.a
SkyhighBehavesLike.Win32.Generic.fc
SophosMal/MSIL-WA
SymantecML.Attribute.HighConfidence
TACHYONTrojan/W32.DN-Agent.403456.Q
TencentTrojan.Msil.Kryptik.16001417
VBA32TScope.Trojan.MSIL
VIPREGen:Variant.Jalapeno.18453
VaristW32/MSIL_Agent.ILW.gen!Eldorado
VirITTrojan.Win32.MSIL_Heur.A
WebrootW32.Trojan.Gen
XcitiumMalware@#3bqserf9cbwf0
ZillyaTrojan.GenKryptik.Win32.976611
alibabacloudTrojan:MSIL/LummaStealer.GX#2XJC
huorongTrojan/MSIL.Agent.li

Network contacts

149.154.167.99 192.124.249.36 192.124.249.117 116.202.1.77

DNS requests

crl.godaddy.com ocsp.godaddy.com t.me ocsp.digicert.com

Process list

NameCommand line
84cf6.Stealer.exe
RegAsm.exe
cmd.exe/c timeout /t 10 & del /f /q "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & rd /s /q "%ALLUSERSPROFILE%\GCAKKECAEGDG" & exit
timeout.exetimeout /t 10