Extracted

• • Target

    f5115ba604bd2b2c63c529c0b90d5e275f9ae5536ec64a12127080d258792944

  • Size

    1.8MB

  • MD5

    c6d75c58036eaa9694f9f6caafe3234c

  • SHA1

    2983b74042fe0ae98316bb8f75f21452b2aac5d4

  • SHA256

    f5115ba604bd2b2c63c529c0b90d5e275f9ae5536ec64a12127080d258792944

  • SHA512

    7b3c544c6a057e9f013dcdbbd409663a4c1758b08f20c51f8241a3e2a5fb1cb1b974700a46c8340feda1bbc98c47c2c1275084c4f212ccd846466c482577aba8

  • SSDEEP

    24576:BvJxbpkPetYosjmpesf6ZSclbU4c1Ryliea5ki4NaqXU6h6FnO8dHlDSzBctqLCN:RHYrcr6Zfuklir0NaqEAgnLd4agej08

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2