Extracted

• • Target

    732f5a28be27709a3ec9536cdb9341355f964b1f34df827db8ad3c7b64802b07.exe

  • Size

    1.7MB

  • MD5

    132da2630afde7e9e0c13b0856c2be5b

  • SHA1

    012d8cf0e9e8be146b75db83eaa56929409d09e6

  • SHA256

    732f5a28be27709a3ec9536cdb9341355f964b1f34df827db8ad3c7b64802b07

  • SHA512

    6b5c133225ba6ad361b2ff52b69232eec57ac23b732f50e9bb442cacbc6559be03630854ea22989a812ce547e7eba00ed70a1ed297c018f68138cc8c541e636d

  • SSDEEP

    49152:zSjMD8Y7Bez5F7uhWENtjvuVjYTR6LO4VpcbVz:+4F7+6TtjvgWpZ

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2