From c9a5c031d28d9b1d737521ce0d0c4bdaa2a8c431 Mon Sep 17 00:00:00 2001
From: bsendpacket <162042406+bsendpacket@users.noreply.github.com>
Date: Thu, 20 Jun 2024 09:15:16 -0400
Subject: [PATCH] Create lumma_fnv1a.py

FNV1-a hash with custom offset seen in LummaStealer (SHA256: 0cf55c7e1a19a0631b0248fb0e699bbec1d321240208f2862e37f6c9e75894e7)
---
 algorithms/lumma_fnv1a.py | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 algorithms/lumma_fnv1a.py

diff --git a/algorithms/lumma_fnv1a.py b/algorithms/lumma_fnv1a.py
new file mode 100644
index 0000000..c17e08b
--- /dev/null
+++ b/algorithms/lumma_fnv1a.py
@@ -0,0 +1,10 @@
+DESCRIPTION = "FNV1a hash with LummaStealer offset, seen in 0cf55c7e1a19a0631b0248fb0e699bbec1d321240208f2862e37f6c9e75894e7"
+TYPE = 'unsigned_int'
+TEST_1 = 2983287169
+
+def hash(data):
+    val = 0x268c190a
+    for c in data:
+        val = ((val ^ c) * 0x1000193) & 0xffffffff
+
+    return val