Extracted

• • Target

    69f34af8c5469523637481e6932c9bbd3323f42952417d37c889989e2e654204.exe

  • Size

    1.8MB

  • MD5

    0b18cf132a2c06c69ffa63a2162c0066

  • SHA1

    29ce991d4b9e48d3229ddad44c21985a86c44720

  • SHA256

    69f34af8c5469523637481e6932c9bbd3323f42952417d37c889989e2e654204

  • SHA512

    83c4db72abefb5df7ce0d7b3973d430544201a653afff2ecabbc7471178dacc6c34a71af42cff77999051e56f280697afbefe2295c88384c83ee77ee1d6f1f7f

  • SSDEEP

    49152:jrWkttjar3NCC0v3ZWeZe+SY7eD7ds2YT1MdNpabKpF:nWkjlCI0eZe+772HdNbn

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2