Skip to main content

Lumma Stealer

Malware Family

958 indicators of compromise attributed to Lumma Stealer across abuse.ch threat intelligence feeds.

Domains

406

IPs

8

URLs

405

Hashes

139

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
bytecloudasa.websitedomain
trafsyt.cyoudomain
poochse.qpondomain
heavywbp.cyoudomain
tasselg.cyoudomain
ulmudhw.shopdomain
shootr.cyoudomain
partyyeisdo.shopdomain
brakyfaw.cyoudomain
brorgma.cyoudomain
lovesozp.cyoudomain
revqhuu.cyoudomain
carpoba.cyoudomain
narroxp.sudomain
obnusho.cyoudomain
skylips.cyoudomain
straigxo.cyoudomain
knittinprophec.pwdomain
mambergame.fundomain
bendavo.sudomain
205.196.123.189ip
104.252.175.169ip
94.26.106.20ip
193.221.201.247ip
5.181.181.26ip
88.198.29.97ip
91.228.52.43ip
94.26.83.69ip
http://thuspulllig.fun/apiurl
https://ohfantasyproclaiwlo.shop/apiurl
https://t.me/abebebbeeurl
https://record-envyp.sbs/apiurl
https://steppriflej.xyz/apiurl
https://greywe-snotty.cyou/apiurl
https://platformcati.sbs/apiurl
https://reinforcenh.shop/apiurl
https://strwawrunnygjwu.shop/apiurl
https://soldiefieop.site/apiurl
https://aspecteirs.lat/apiurl
https://gemscocl.com/nfront.phpurl
https://flasrta.cyouurl
https://crosshuaht.lat/apiurl
https://vozmeatillu.shop/apiurl
https://deallerospfosu.shop/apiurl
https://smeltd.cyouurl
https://spellshagey.biz/apiurl
https://unityshootsz.site/apiurl
https://miniatureyu.lat/apiurl
4a6e9e4d8c6e503a1729a8acdfafec12eb2b4c0ff4b10c3fd33c9ed3cff98c3bhash
a2e542e81caacf5742f227aeec06f54f95825b25a07a2463628b73b84a9ee65fhash
d9a64162a8c7015b027fabc44d481aab603365c1c061efedc2885479967084e1hash
38a4243f13bd1da64a5439304d0411d7c213a177f0706ca4a5e92802d1d45b38hash
5695a75d96e56497ab5f7175d5c1da59a4565df668cb89db774eefbb5bfb6cf5hash
6c17b1acfdc04eeb8a421bdd498fdbfe489b45d1c345c8dc7167f7c3d6d7c38ehash
a2875c6be2294af9b58ad26740ced38be55aaefb5386111f0b83e652c03c6af2hash
e722b1ec7c893209be4e092e4db1aefe498cd87120350df2049f2d50b5e5bf1dhash
0e7a089b248c8086a8b472a3f0cd5393372080f5afe8f2adb5e007487c895de7hash
9b1fad1eb049d54f44103ba67be774b96d2cfd82eeb5ec72aadd20ec29d846f8hash
40d7986007fb4b39a16e527ed3482f337c5949355c8680f911339be617340965hash
6270f38bdf27aebb108331a484220a8bc0b9a1e6a2c4bba6dad89a2f3665bca5hash

Another file to check? Run a file hash reputation check.