Extracted

Extracted

• • Target

    59d5081a3b24e430201013f1ee75a853559126d688d984e3025acaed80312cdc

  • Size

    1.7MB

  • MD5

    a10997a94a5f8b498035228d7527ace0

  • SHA1

    e4c524d4cd8c9e2ea3a6c7e3adb2b7a1ec6d98f0

  • SHA256

    59d5081a3b24e430201013f1ee75a853559126d688d984e3025acaed80312cdc

  • SHA512

    1159446b139422ac84ba3d385b759b19561533c10cac1b5e04f8e5e77a520929ba9ee3ad0445b3cf9a52d274e421a066ebf3a3dc5ed4cd0bdc00f0f1357f8afa

  • SSDEEP

    49152:5T3mle9yQoiW1GMffyR49Ro+5AJMngj8:d3wmW1GMfo06+5AyQ

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2