LummaStealer
Lumma Stealer is an information stealer malware family in use since at least 2022.
4New IOCs · 24h
17New IOCs · 7 days
580Indicators tracked
4Independent feeds
2026-10-12 04:00Last activity
New indicators per day
2026-09-29 to 2026-10-12, by first report.
- Hash21
- URL1
- TLS cert557
- IP1
- Malware22
- C2558
MITRE ATT&CK lists this as malware Lumma Stealer. Explore the ATT&CK matrix →
Where its infrastructure is hosted
Latest indicators
Filter the live feed →| First seen | Type | Indicator | Role | Where |
|---|---|---|---|---|
| 2026-10-12 04:00 | SHA256 | 0789252a0370875bafbfb10f2cb86365e8fe1fe78479cc81f842df2c319ff77c | Malware sample | — |
| 2026-10-12 02:18 | SHA256 | 15b67d1c9943ded17553939213a1c2d90541d05f59deee44e4ed2903d828ff16 | Malware sample | — |
| 2026-10-11 15:33 | SHA256 | aa3e272241995ceb22e7b70239b1d010482af721ce7c6ac6bde70c5cfb3e156a | Malware sample | — |
| 2026-10-11 14:09 | SHA256 | 0ef1d4be6ed364101bd09309a5d218172762460579e47dc024f7c35c1b5de7cd | Malware sample | — |
| 2026-10-11 05:18 | SHA256 | 9043fddbf88a56f784bf4d52c3ddf7837cc8206e77fe831755e8ec511e5d4329 | Malware sample | — |
| 2026-10-09 11:03 | SHA256 | 9fbf061258d813065b5ce20f5a74ebf7ab3ec18e8f3678b3f7538c16b5223eb2 | Malware sample | — |
| 2026-10-08 18:04 | SHA256 | c21557a9b8df651692f8a6241e488dcfba8faf2dce446c14f5854ba1fa04d7f4 | Malware sample | — |
| 2026-10-08 15:39 | SHA256 | 775d25d0bc3125ae6df9a2e84cd448e2108ae7edf6d66916e39f97e9b5cb86e2 | payload | — |
| 2026-10-08 15:39 | SHA256 | 479b3c923be6125530e99f24e611547aa5d8861d1e88b75a03ce5527a2052213 | payload | — |
| 2026-10-08 13:25 | SHA256 | 138671f56898c4504a02588c6f9c4de6a3961ce015bb147d579bd54bc454ded1 | Malware sample | — |
| 2026-10-07 09:42 | SHA256 | c073f5c684eafc2b0b0c6dedbf6aaa0148f5d1e6f5cd4b1090a88991a22c89bf | Malware sample | — |
| 2026-10-07 04:15 | SHA256 | ca8bb1c036f5fe045197f262a9fb998614325a4d3656a908d66d2154452d75ef | Malware sample | — |
| 2026-10-06 17:18 | SHA256 | 195669b35daa53ca30d9b9bf7e93eaef8f48c610abfd039e74e015d50a3034af | Malware sample | — |
| 2026-10-06 15:15 | SHA256 | 0559bc25634e133cef0f1923700d3e6dcfdd28018548bb4a75261ba5aca936a7 | Malware sample | — |
| 2026-10-06 15:15 | IP | 94.142.138[.]199 | Contacted by malware | — |
| 2026-10-05 21:46 | SHA256 | f51bd6b15fa0908f2996bbecdaaf7571a578a8d22df7a99c34b420b630fb8ac3 | payload | — |
| 2026-10-05 16:47 | SHA256 | c5b47b6fb38693695b05ccabc05abb68ca5a620590eaf068c93da0f7f03bd66a | payload | — |
| 2026-08-14 07:35 | TLS cert | a45080c92a0b2314966517a4643ebf280e88a11b | Botnet C2 | — |
| 2026-07-13 13:54 | TLS cert | 501d817bb1780acfe5e47082c43472bda8068e4d | Botnet C2 | — |
| 2026-06-15 15:31 | TLS cert | 2beac2ee8b2fe7625d4de9f5381d37f200965f91 | Botnet C2 | — |
| 2026-06-15 15:31 | TLS cert | a46841d623a191366909b24375bee0eceea23bbe | Botnet C2 | — |
| 2026-04-15 07:12 | TLS cert | 272e76f605bec1da1ea719df8dc0e7269de7d44e | Botnet C2 | — |
| 2026-04-08 15:28 | TLS cert | ab7f083d77dc2b1b71c0aec9a417e0a5a036a5f9 | Botnet C2 | — |
| 2026-04-08 15:28 | TLS cert | 7ce02a4df627573696141e40970ef60e246f9f3f | Botnet C2 | — |
| 2026-04-06 08:21 | TLS cert | f58ffe7484653b53cea539b23da25bc8eeeb2c05 | Botnet C2 | — |
| 2026-03-28 07:32 | TLS cert | 2ebb8f663f93eb9c8f169cc09a86f6dba1c85584 | Botnet C2 | — |
| 2026-03-25 16:13 | TLS cert | f05a2876d9129ec057ecaedfac9cc37ebe2138ad | Botnet C2 | — |
| 2026-03-25 16:12 | TLS cert | 460e554589554e5dbaeb2c6f4c6aaf93e31da41a | Botnet C2 | — |
| 2026-03-24 07:48 | TLS cert | 7f065e37b5c0112620f7c97d3cd761e626e0faf4 | Botnet C2 | — |
| 2026-03-24 07:38 | TLS cert | ba19ffedc0a28ed2055127327e4cd6873dcf5a4f | Botnet C2 | — |
| 2026-03-21 10:26 | TLS cert | ca0c1280a2c26415f8d77ca00a39c6986841da0c | Botnet C2 | — |
| 2026-03-21 10:26 | TLS cert | fdd41b75b65c0dfb3a3873ddca6d77723a5e92b6 | Botnet C2 | — |
| 2026-03-19 13:00 | TLS cert | 0211433cfdfedfc7352c1228fc58d9d2f9d49032 | Botnet C2 | — |
| 2026-03-18 14:31 | TLS cert | 8ebe0d48a1178a816162ca9b034b7b653d0fc12b | Botnet C2 | — |
| 2026-03-14 17:16 | TLS cert | da0f6a5937d3c2d365ffeddb881b4136313e1afa | Botnet C2 | — |
| 2026-03-12 07:14 | TLS cert | e30905555de39d1e66f834f672f6f14e9106839b | Botnet C2 | — |
| 2026-03-07 18:11 | TLS cert | f9e8d701de1740086da792e2c9be70df261e1832 | Botnet C2 | — |
| 2026-03-07 18:01 | TLS cert | 20f30e05d2a2de117bdad78811946e112dc4dd6c | Botnet C2 | — |
| 2026-02-23 08:31 | TLS cert | 2987e30402370bdcbf291aedc9cd52a9a79bda0c | Botnet C2 | — |
| 2026-02-22 16:10 | TLS cert | 6fd95f4a2d9cec238cbe2e1756890381c4fae3cb | Botnet C2 | — |
| 2025-12-09 15:21 | TLS cert | e2293f74d8d72bde90bb0424038259a9e3126e1b | Botnet C2 | — |
| 2025-12-09 15:21 | TLS cert | 69101b8edfa5d5e2ead4512a6d71c84748b0c012 | Botnet C2 | — |
| 2025-11-18 06:30 | TLS cert | 1d28cc6dca52e95f859739c39a04d794671f66d9 | Botnet C2 | — |
| 2025-11-07 07:58 | TLS cert | 7b7c48a7d10c11ab988801fec68db41f6935ecf4 | Botnet C2 | — |
| 2025-11-05 16:38 | TLS cert | b57cc0f34294222d350c45d62c735547c8882195 | Botnet C2 | — |
| 2025-11-05 16:38 | TLS cert | e26cb841e2adfefbb342442fc67a645cd943b1a9 | Botnet C2 | — |
| 2025-10-26 16:42 | TLS cert | 63a759ea1edd5660e73d4706b302dfb2971755c2 | Botnet C2 | — |
| 2025-10-23 06:06 | TLS cert | 12003ccd7ea693b739abe8c08dfcaada49ce38d1 | Botnet C2 | — |
| 2025-09-25 13:29 | TLS cert | 3ca95d4931548c282db9c3884d76135281a3ad11 | Botnet C2 | — |
| 2025-09-18 14:03 | TLS cert | 4614828b77aa3ea3a75e043efdf8183e8a0e4890 | Botnet C2 | — |
| 2025-09-18 14:03 | TLS cert | 609516f74b3b47762d5b1a6f7554b09d75cda982 | Botnet C2 | — |
| 2025-09-11 06:30 | TLS cert | bed4bb748bfb98fc0756d0fa95f50d60f91f74b1 | Botnet C2 | — |
| 2025-09-11 05:59 | TLS cert | ef1449034581f9104b8f1d83dc458a632872a8d9 | Botnet C2 | — |
| 2025-09-11 05:56 | TLS cert | ad081f41449e06c8e92c395c57b0bd1e4fdb7774 | Botnet C2 | — |
| 2025-09-06 06:37 | TLS cert | cc6f02c114a6950662f49b7032b7901c38cc20c1 | Botnet C2 | — |
| 2025-09-04 17:34 | TLS cert | d602e76cd1ca37e73d58a6496e6f9c0c34dad338 | Botnet C2 | — |
| 2025-09-04 14:31 | TLS cert | 4ffa26fc8898fa59d0c82ff768649559686691cf | Botnet C2 | — |
| 2025-09-04 14:17 | TLS cert | 30b49818742c968be1342a949a1911bd23b36578 | Botnet C2 | — |
| 2025-09-03 06:12 | TLS cert | 9d541d42e278bd542a3c57ba584230d63de6d542 | Botnet C2 | — |
| 2025-09-02 05:43 | TLS cert | a42e22cc20f8e907d7bb4d01468929ef466d3459 | Botnet C2 | — |
| 2025-09-01 09:12 | TLS cert | b60218617e52bec3931b0f2ebf5013cbadc8afed | Botnet C2 | — |
| 2025-09-01 09:04 | TLS cert | 497f2c84c223602794cbe4481e2641bdb55d81a7 | Botnet C2 | — |
| 2025-09-01 08:57 | TLS cert | 666a7eebb92bc25463267cbfd76a723e4aceb207 | Botnet C2 | — |
| 2025-08-28 06:44 | TLS cert | 3cca8cb7ed318a30cf4d69a7425066e1f9e1d56f | Botnet C2 | — |
| 2025-08-21 06:05 | TLS cert | e82a7a3f490886dfc689887f6eef71db44f41181 | Botnet C2 | — |
| 2025-08-14 12:21 | TLS cert | 559731b96b24f1b953b75965978fd694752d5027 | Botnet C2 | — |
| 2025-08-09 09:34 | TLS cert | 46cba254d23bd7e646a60c5f5ae3badf07d20516 | Botnet C2 | — |
| 2025-08-09 09:34 | TLS cert | 4f77392a6ef2e245d946a4cfc0678827a66c2c27 | Botnet C2 | — |
| 2025-08-06 20:31 | TLS cert | 320711e1c61663e80e227827e3202f20ed0ab2c5 | Botnet C2 | — |
| 2025-08-04 08:38 | TLS cert | 8ec344c9138e831ab739c22b416293551094c56e | Botnet C2 | — |
| 2025-08-04 08:15 | TLS cert | 64a198f08cbf53e839d4e45015ae3f062354bfca | Botnet C2 | — |
| 2025-08-04 08:15 | TLS cert | 72548212bfca535abbeddc574b99b2486925b573 | Botnet C2 | — |
| 2025-08-03 16:09 | TLS cert | decadd140b395bfa067062af8eaebb4061234e83 | Botnet C2 | — |
| 2025-08-03 16:08 | TLS cert | ad396f061e036cbad87a6171e8ec1d4d83701106 | Botnet C2 | — |
| 2025-07-29 19:15 | TLS cert | 9ed1fea23b6b05a5c4f351ac58e6b1be7698c248 | Botnet C2 | — |
| 2025-07-29 07:31 | TLS cert | 13ca4983ac42972ec0201ae1350baa210b782ef0 | Botnet C2 | — |
| 2025-07-29 07:05 | TLS cert | d9edbcf7a35af6e3b4491ca06eaf32be71c77f0e | Botnet C2 | — |
| 2025-07-28 18:22 | TLS cert | 456f7003277045054be243d6678db735d2cbacfc | Botnet C2 | — |
| 2025-07-28 18:22 | TLS cert | eca024b935a6d626c5635319a2d4645dbe2cc7ff | Botnet C2 | — |
| 2025-07-27 17:57 | TLS cert | 743d3905f84e4bcf7ebce6f0c744873c0f7191fc | Botnet C2 | — |
| 2025-07-27 16:11 | TLS cert | 7ccd44d77b64e3967be81d85fcea8f13a40cc4c5 | Botnet C2 | — |
| 2025-07-26 10:00 | TLS cert | fa613f7efc650eeeca04cbedae8431f29118f471 | Botnet C2 | — |
| 2025-07-23 07:48 | TLS cert | d135667b3a95cb7eee34908c06efe7ef9f732b1c | Botnet C2 | — |
| 2025-07-23 07:48 | TLS cert | 31a5f9dcc121652c418f012eab842f3fee50e4bc | Botnet C2 | — |
| 2025-07-23 07:48 | TLS cert | 8dc0f6294c8ca28cb2314a0f5901fc482e304387 | Botnet C2 | — |
| 2025-07-22 05:53 | TLS cert | d61f4dfd2892d8b51656df8d35209cd08dbc7703 | Botnet C2 | — |
| 2025-07-22 05:49 | TLS cert | da9ee0e55adf15aff9c9d2581cbad9c4daa12394 | Botnet C2 | — |
| 2025-07-21 12:24 | TLS cert | 6ebdec5403aa1c5e3cddf39da5e41c6e34af6ffd | Botnet C2 | — |
| 2025-07-21 11:08 | TLS cert | b29918f4024f11e06181b0e998187f046262c282 | Botnet C2 | — |
| 2025-07-21 11:08 | TLS cert | 8b3baed4f41eadefceea9348302d3aeea0703363 | Botnet C2 | — |
| 2025-07-21 11:07 | TLS cert | de08fecfbace5047baac498e8e43f44efdc05d95 | Botnet C2 | — |
| 2025-07-20 15:12 | TLS cert | bc14df138eb32c75e280ff5a51157f78cf3e80e6 | Botnet C2 | — |
| 2025-07-20 15:09 | TLS cert | 2b87167c2c1dc2a969812e065f85260759d86381 | Botnet C2 | — |
| 2025-07-20 15:08 | TLS cert | 0687370c542b2c0a895e6aefe03d97551527816e | Botnet C2 | — |
| 2025-07-20 15:08 | TLS cert | 460dc0aa4bb5618fca4295ae1cbdcaf01da25d50 | Botnet C2 | — |
| 2025-07-20 15:07 | TLS cert | ebffcf13aa66274c54cf47615a7cdfb42503ad12 | Botnet C2 | — |
| 2025-07-20 15:06 | TLS cert | 53f2c7e4e9501dfb4dcb307af9fc14777d4bfeb2 | Botnet C2 | — |
| 2025-07-20 15:06 | TLS cert | b462e76c6de6db14829247b84e4f78abbdd5340a | Botnet C2 | — |
| 2025-07-20 15:06 | TLS cert | b10e074ec6690ffba5afc77981e75c2d994534c2 | Botnet C2 | — |
| 2025-07-20 15:06 | TLS cert | 247eeb3a4391bb38cc70e5bc58a6e97615d128e8 | Botnet C2 | — |
Defanged for safety. URL query strings removed.