Extracted

Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    06cdf5cbdfa34fce7dfde3b0b0fb8258

  • SHA1

    5acef066031742cc94cbcd9cbb34b2f36b8292d3

  • SHA256

    a751a6e56e59c37aa6371702d8e1f1651b28d9632b98ff3e2673f16052594e14

  • SHA512

    907fb4404c71b586872f212d12161993309ecc9ba13551ae674da7da2d1a055fe9a618a7ddcc4619e27b297b90b94d73e7765316a60f15d35973b6d38b2ca39b

  • SSDEEP

    49152:QIZKwvcNCirq/1RgTVa5fQiXDsDl80iveF:3ckcNCirq0To50lN5

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2