Extracted

• • Target

    a38ae8a1930668deab4303643fa01807.exe

  • Size

    3.1MB

  • MD5

    a38ae8a1930668deab4303643fa01807

  • SHA1

    36db91eaf9927c112e3ee2226dddae9e79e02562

  • SHA256

    3dff203bab1db4bd7012e5daa23e467f7919587e5a306e497edb85caa2497dbe

  • SHA512

    8f9d91bbd31f3873b3f3d9bdf6572986fb18c4a8d6b536f450e15c548f8e009850fece4804267a16e4c7a457a1de6e5ba620efa4d86c8058a82fb6139181de25

  • SSDEEP

    49152:Q87rM76glSA2JVgP9Fr308sWf379GGe4/9RJGV21mAwXm1PF+B0jzqCS:5e6gp2Lg/0Lu3JD1RJ+qmAwqF+UqCS

  Score

  10^/10

  lummaevasionspywarestealerthemidatrojan

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2