Extracted

• • Target

    58c7ae8fe36bd1cdc9911a2d976f92c7c8971b958412ded09b62bcf077afb5d4

  • Size

    1.8MB

  • MD5

    2095278b1ef0858394a0c9c6caecc543

  • SHA1

    0e7b8d7ed51956b956f227a8f25f4effbc2b1245

  • SHA256

    58c7ae8fe36bd1cdc9911a2d976f92c7c8971b958412ded09b62bcf077afb5d4

  • SHA512

    e041608929fcedd3eca05148fe12c57a16d5ed390c2e78b961b0b4f2052dd962db5c4dffe9e3ffa0e2a865add0973b48f693067f07f21be9592afa746b8a5e3e

  • SSDEEP

    49152:KAmylkXZNOds9o72zi8iHDDzLjKF9Z9vZd:0J44oazfiHMl

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2