Extracted

• • Target

    10347a78e71516e8a8bfbb947a1dd119769ead4bb253350e7026b223b53d40e6.exe

  • Size

    3.0MB

  • MD5

    e6036cd41d48a2ca17e405403129fb48

  • SHA1

    4a215fdc2429c1aefa062ee0b506bf8fc89010e0

  • SHA256

    10347a78e71516e8a8bfbb947a1dd119769ead4bb253350e7026b223b53d40e6

  • SHA512

    662deaa2570fadeb42e46d10f11d703a6eb63c6dbaaf95c7d134b7a37d015bacf601f1cec73a0900929dc1da83defec5b6adfdb4224c70e13e406a11bdd572cb

  • SSDEEP

    49152:GIIYfTVcxT4tKmfH+3oS4B4q9IZXlqikRGhOkOhbTo+:GGTV90mfeYS4B4qoQ/RG4hY+

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2