Extracted

Extracted

• • Target

    7ad8a2c13109c222bbb82f5ac643c3b97f9ac8ec4e0a689b05c1d3fc74e2ab51

  • Size

    1.8MB

  • MD5

    9300f863f2ce8a50ce8ce438363ab8ad

  • SHA1

    4f9e4359f394c090c77dd5fc041adafb7aff0453

  • SHA256

    7ad8a2c13109c222bbb82f5ac643c3b97f9ac8ec4e0a689b05c1d3fc74e2ab51

  • SHA512

    f59ce37ea2667d59bab3d495d3cf1d881b25d8939e2eea6107284814f54201e4121b6985b2b90a30a83776bfc3bced7e92373eb66b71c0daa570fa906247dbc2

  • SSDEEP

    49152:bKo8ODdzD+SwyRVghFnEH3+h4l0rAOYab:tDdWSwWghFnM+LbY

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2