Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    c7448b9c766b487f3d44be16ae6d0fb7

  • SHA1

    e8a47eef7971f3752821ccd40848fab98de1fc8c

  • SHA256

    18fabc1fc091d6726ca2e5b045990d57af2da9d9d64d8fa4bfe02e50761919a4

  • SHA512

    db4051d384c1e8bb704a725546fcd820fdc86029830069ac3e98511dfd386f776413c2155645dd50132887b48735efacd45ae026c9b21194a7052fbd6afcca49

  • SSDEEP

    49152:xlyppwgI4fKn5ri5D51xztJhtcL/mi0wr2UMV7dl:I25i51L2uibr2UY7X

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2