Extracted

• • Target

    db38dea60a3e99d241f427db9ae90a3ba5aa2e64b7b797458c573dc830a4c50b

  • Size

    1.8MB

  • MD5

    0ed36188711a846f14a7423198e8aaa7

  • SHA1

    4431bd50a97609edf1e9c4fcd3eaf0c4b7598d10

  • SHA256

    db38dea60a3e99d241f427db9ae90a3ba5aa2e64b7b797458c573dc830a4c50b

  • SHA512

    1e5aee9dcc38d607bf95ab7e453c73c33a6a955c02343de9becb550e3f4ce3e18772887993121e116fb58c38617e9ed05a1f7afde2a67bffc037805abf3345a6

  • SSDEEP

    49152:0edMC3wgrRN00Em+FRu1bhXYITkLCrncCHf:0UpAgtNUe1dX2bC/

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2