Extracted

• • Target

    bd30cfe5a2911e59db13304b10fd9e238958cf7dcb845f5cfd179dce9000de6a.exe

  • Size

    1.8MB

  • MD5

    697eab6b7cfa543b157bacfefa768a23

  • SHA1

    dd0c2d110d28a6a5a575b9ff75df495c6a568edb

  • SHA256

    bd30cfe5a2911e59db13304b10fd9e238958cf7dcb845f5cfd179dce9000de6a

  • SHA512

    aedaa130af512a22a472247efad4996b4c56467e5beac2056a5bdb397ff27e00a2809b00a2d8ce3f5254f20c47f0b9a69594486422cf57f604974a9d074bfd96

  • SSDEEP

    24576:ZdTL1PtfPwl8LppNG+1aBVw4zvYJNF0ka3+fQEs9s7+Vjz3LCAjdjJH:ZRJhI+VHGQaBy4zaNqk60QxPj

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2