Extracted

• • Target

    08baf4b34f679c696f7f83e57cfb476cff9deae86b9bc38b1e95917011ad3afb.exe

  • Size

    1.8MB

  • MD5

    51752f8f0a90840cbb8b22301e889b9e

  • SHA1

    887bbf246857f37cdba8b1a2fb561f23a4816167

  • SHA256

    08baf4b34f679c696f7f83e57cfb476cff9deae86b9bc38b1e95917011ad3afb

  • SHA512

    254e00227c18a490b9e0a685e2287c783279319df62aa528971a7ce0d06badecd7405687f9822132686dc53bc1e4944dea0470a567ad6261102ccec456b89885

  • SSDEEP

    49152:FYFw6ej/SH0MTSg0r34ZZajjO8IL0lIwk4rRX4UR/fLSs:Unej/SHIg0r3+ZoVWMIw/RB2

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2