Extracted

• • Target

    file.exe

  • Size

    1.7MB

  • MD5

    afd25f2fa473d794759a6e9f51c50d87

  • SHA1

    4f874fd536a0a8a0cf044ee47f25785a8a957c4d

  • SHA256

    473ab5b030273598bc64ab38aafdc6666239c7aa63682f3ef44ffd9dec83b576

  • SHA512

    834e73f6e671375f844f97c9620aff1da7d2d755a8e7f4c4a6cf458207f763478f594499b821b5d74191ca097e347cba5ef91f0ecb205f1666522388cb95bd4e

  • SSDEEP

    49152:m6MeKCyNJY7lRIkrucgyud89XJn4x4Wm:vYNmTHicgye0XJsm

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2