Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    aa1848a9a16aa15d7856a7026d49f19b

  • SHA1

    b62bbc9c0f385f542eca38955c73af689e492c39

  • SHA256

    10bbb6a485613807f9253ec55295429463fac355e39b1b450d7d88dcf98f1959

  • SHA512

    0b4378347cbd64948f6ae35b9e71f91f464655b8e9778ac4e26ea7eb6532cf9ef8756cd5a5c421dc64a5f629032bb82975960dfaef5c18cc29c30cdc4705ae24

  • SSDEEP

    49152:D+vZB99yKgx4nonwUsWp38Big8l0AGakRO/1cWqZjHN6X:DeZBryKglwUsENgf5p86JN

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2