Extracted

Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    95a269acc2667e85ec3c67f5f76e0fe5

  • SHA1

    85b4c01a1f5a65cfe084165bbba00493a74b6a1a

  • SHA256

    d8bf15f010a88817bfff05c7df61fba23676d5fe4d3a8deb5073fc7fa5255a3c

  • SHA512

    be24721f2eec1b3240837a1d42030d58de00cbcd66d6db183a11d3f00e2829859b4813b1a6bcdffcba0c7352975618df95212e723d0bb65a0c360dd8fd1a20dd

  • SSDEEP

    49152:T+CpEPJMG9YTTFqmDuODCMo2c5C30FMH2Bx7VIHN:yLwTFnzDCBbC0KH2Bx7VIH

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2