Lumma
11 cached samples attributed to Lumma by 2 sources, through 5 distinct vendor labels.
Samples
Newest cache entry first. Every row links to the full report, where each source's own answer is shown unsummarised. The labels behind these rows are listed below the table.
Why these samples are here
Each source returns its own string for a family. This is every label behind the 11 samples above, the source that returned it, and how many samples carried it. Counts overlap: one sample can be named twice, so they do not add up to the sample total.
| Label as returned | Source that returned it | Samples carrying it |
|---|---|---|
Trojan.LummaStealer |
hybridanalysis | 6 samples |
4 more labels carry an engine suffix or a second family name
The same evidence in less readable strings: an engine's own suffix, a variant token, or a label that names two families. They are still this family's evidence and they are counted in the 5 labels above; a token the alias table does not know is never guessed at, so it stays exactly as the source sent it.
| Label as returned | Source that returned it | Samples carrying it |
|---|---|---|
trojan.salatstealer/lummastealer |
virustotal | 5 samples |
trojan.lummastealer/salat |
virustotal | 2 samples |
trojan.salat/lummastealer |
virustotal | 2 samples |
trojan.lummastealer/salatstealer |
virustotal | 1 sample |
Named alongside
Counted per sample: a sample tagged with both families adds one here. This is co-occurrence in vendor labels, not a claim that the two families are related.
Derived from cached source answers, newest cache entry 2026-11-02 15:30. A sample leaves this page when the cache entry it was read from is replaced; a generic or unrecognised label never put it here.