ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 6270f38bdf27aebb108331a484220a8bc0b9a1e6a2c4bba6dad89a2f3665bca5.

Database Entry


IOC ID:1873582
IOC: 6270f38bdf27aebb108331a484220a8bc0b9a1e6a2c4bba6dad89a2f3665bca5
IOC Type :sha256_hash
Threat Type :payload
Malware: Lumma Stealer
Malware alias:LummaC2 Stealer
Confidence Level : Confidence level is high (90%)
Is compromised? : False
First seen:2026-08-13 11:51:15 UTC
Last seen:never
UUID:6331b9c6-96fe-11f1-8a3d-42010aa4000a
Reporter Sir_XX
Reward 5 credits from ThreatFox
Tags:ClickFix ErrTraffic etherhiding LummaC2

Avatar
Sir_XX
ErrTraffic ClickFix chain. Hash1=native x64 injector (50KB, GCC/mingw, CreateRemoteThread into svchost/explorer, served at /st1k23g4bkshdfiyusdfs). Hash2=Lumma Stealer CLR host (316KB, MSVC 2026, served at /enterprise/student_s.bin). C2: 158.94.211.92. BSC dead-drop: 0xFB448D465841C63F3bC433be61Eb692b813D469d