Extracted

• • Target

    d4ca0dfcfccdb18d559519c931c2d2a7a34ed3ec32539f89b028a62e273ae235.exe

  • Size

    3.0MB

  • MD5

    2b65b7efb37e8c0abd42f14437353c10

  • SHA1

    ea4fccd8512f877b253c2f6736309949983b2997

  • SHA256

    d4ca0dfcfccdb18d559519c931c2d2a7a34ed3ec32539f89b028a62e273ae235

  • SHA512

    6ff64dbf70d59970160c77386c7e1b5a8f84ac715c2edc0051d511be729c74789a0406199fdd13d35b8f83055e84b5c4bbf896cc2bb1a89654beb87ea3d8eb58

  • SSDEEP

    49152:5kBV9e9VUV2z3J8199BF8tdejSrI9Dv0gS2ooxEeggo4mhx:Wuz3J81jBFKdmSrI9Dv00BSgo4mD

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2