Extracted

• • Target

    678f3ff74a341bc6d6bff5f334508e4ea8305aba0e33c134fd5b0af3cd957d87

  • Size

    1.8MB

  • MD5

    9c292208017062c4d09720f198405a75

  • SHA1

    58fe6e3ff91f890537887e47cf68d8276d9f30ec

  • SHA256

    678f3ff74a341bc6d6bff5f334508e4ea8305aba0e33c134fd5b0af3cd957d87

  • SHA512

    8deb6b92eba12cf9603a9e586489d57b2ef67a919ca0bd123f1f74d489c0bceb0e1e09ad7245dbf4d0f4ae47ae3c379b5380e95b88db4b46869ed39499e84f9d

  • SSDEEP

    49152:BcPkKYK/QWasWmylC6lFDOI9czmUVoxUF69v:BcOIQboyl9FDOIemWoxK69v

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2