Extracted

• • Target

    e13160b41a6f39021de008cf0024532d7b717559c2ec7ca72244c07f54705187.exe

  • Size

    3.0MB

  • MD5

    758ce951d2f5d9fe7703370d0476e18d

  • SHA1

    cb5c7b97386b870e25b45902ea247e10b1536554

  • SHA256

    e13160b41a6f39021de008cf0024532d7b717559c2ec7ca72244c07f54705187

  • SHA512

    edd94e9541da5a40297991342973180a4448d868416b174ae9c3bf42878164e4bd30f6680ff4ddf9a1450ce4e9d925b72648729ba20858965996bd70e9f8cf42

  • SSDEEP

    49152:QZCdvrrE3wiLRGf3O2xqYIkAHdf81HpaSvggKJff5OGmI:HjDiLRC+28YIkAHd01gS9kf5Oa

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2