Extracted

• • Target

    c2652bdf3340ad6cd3d271874c9b93da3d768deceebf010fbb041fc597438449.exe

  • Size

    2.8MB

  • MD5

    bf70a7ce96dff53fd4e297f5c277d48d

  • SHA1

    5045765fc11f963e7a3fb4bd0363349ca971895e

  • SHA256

    c2652bdf3340ad6cd3d271874c9b93da3d768deceebf010fbb041fc597438449

  • SHA512

    7b929d05b60bef18aa2003dfdd8dd37d4afdb57c9663282b9b3f20e707889e41cba27c13d5ced73040ddcba285e438a95a720ebefbc152b69d20e85e13cf2428

  • SSDEEP

    49152:7ah0/zp/EOzcO2CIJGou/8QoM8TqpcUd9:WG/t/EOzc/Go3DM8T0

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2