Extracted

• • Target

    1aebe3fe1b3990a8cdd1ba65a2a5fb740f72e77bb04a97c6263a10223b755907.exe

  • Size

    3.0MB

  • MD5

    fdeebd1b6381bf6e2f74349d102668dd

  • SHA1

    354abb9385ada34c92870f335012115598c5c307

  • SHA256

    1aebe3fe1b3990a8cdd1ba65a2a5fb740f72e77bb04a97c6263a10223b755907

  • SHA512

    710b5f2cbfe8c25bad1d290a63969c07b58e35a787eb2c9c059f51a6bd859eb712fe778cdbc0b5c9f4c75b08553197f506720b711eabd82773e9601bab0676e9

  • SSDEEP

    49152:ZmHP5+ZrMmlZl6qqtftFX2h5jrws4lYs2ZkjU3:2P5CImLl6qqRtF65jraYs2ZkO

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2