Extracted

• • Target

    file.exe

  • Size

    2.6MB

  • MD5

    25878d05da17b12a6a881c9eee286ecf

  • SHA1

    718bd9780867fc65ae9a5edb72dfa521032857f9

  • SHA256

    92375481f3bbd1087b7052a928c1dfd054a912787fd68c4871a87bf5e5c7a06c

  • SHA512

    5552df151c435381851fb165611236490720028555e4ddb7f97ae53c221a0540cf0b94679e5e522604b897bf4dea27345be992820b7add432d20d9532dae9124

  • SSDEEP

    49152:7hw1/O9xNvzr8Y+F3ByAMlcqOAeCMYVpnCcU563uiSiwK:NwExNvv8Y+pBVMiqOAeCvVpCcUs3BLwK

  Score

  10^/10

  evasionthemidatrojanlummastealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2