Extracted

• • Target

    38f3114f8fcae9dd6a3afc296e2285f01b5385b8de34105fff33609446a3fc56

  • Size

    1.8MB

  • MD5

    6399570aa60f6640ad8aa97296cdcacf

  • SHA1

    3dc4764fc859022d8752deaba17f5336682a1263

  • SHA256

    38f3114f8fcae9dd6a3afc296e2285f01b5385b8de34105fff33609446a3fc56

  • SHA512

    c5a678239c6da2603f7532442cbc0a3e912c5cae7e1f49d7109a655ada8fd8d866a206f6af8d89865ff361240e83b6754fd88acffd4ae63d150f85b14dc57233

  • SSDEEP

    49152:wJ9jb0wzVTAyrSsGeuFu2gRRFc0Hyd7WLWoAPA9:49cwzusGeuFu2edyQTAm

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2