Extracted

• • Target

    ab2e92bf1d70567a32aef956b7d64cbe4d49dadf779fc6d455674fab35509b14.exe

  • Size

    1.7MB

  • MD5

    2fe2ab5b511de6ef48e3eba0378f3e12

  • SHA1

    c350d71c99c8c079714e71c219c706c6716a22aa

  • SHA256

    ab2e92bf1d70567a32aef956b7d64cbe4d49dadf779fc6d455674fab35509b14

  • SHA512

    4beb110952f7f3d6f351149448344f0e5918694bfa3fa958e08690999e16f270abd32100e2d844c5a13564e4c8fd664d17882979e6ca567111983ef62ee4768e

  • SSDEEP

    49152:wuMibW6eQLeyJ42kHXOYYp8fhUNL/EznlfM/O1z7Z:FlSBQz42kH+YYS6L8j1uO1

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2