Extracted

Extracted

• • Target

    2a6884370f538f96e6a9a4a8b9a8e7422004eefbc9e8dd08acba1f841d67b41c

  • Size

    1.8MB

  • MD5

    6dba4b98e84876a7ccb0a32ca8d98e4e

  • SHA1

    171ffa56c99eed0283e8d4cde1a66cbd7edc8778

  • SHA256

    2a6884370f538f96e6a9a4a8b9a8e7422004eefbc9e8dd08acba1f841d67b41c

  • SHA512

    063d6b3eea322186fa171ad917c4e273fe674b617951df16205ab5402395692f84b2ca8f4b178217cc0f829ee664c1b5958680e410d69f3dfb98029d40cf1442

  • SSDEEP

    49152:38LAOS/QZJIAV/j+x2Z5L6rLJDGLKuP9mrxuUmh5H499:sL0/QjcxuL6rZuPIrEUmhBo9

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2