Extracted

Extracted

• • Target

    686c2705e22fc7bafa4b72f9186647d6a87e2f8bf48284f68c42c5efbf315adc.exe

  • Size

    1.8MB

  • MD5

    b74b5b7cc002895b1f65f88925f0d242

  • SHA1

    5e684ea9fc6f977ad8299f4585e4622bb4aec175

  • SHA256

    686c2705e22fc7bafa4b72f9186647d6a87e2f8bf48284f68c42c5efbf315adc

  • SHA512

    7d450eb04fd5ece2c7ae9c17428c51316df5791e67a24ca05011745cb680a8f2a5b48f317f439059f2277c4a81fee7bc6db7f82a9f28231a02abf2ee7101f5ed

  • SSDEEP

    49152:LwAPTbvGkIyzS5k+dFDGZ0fN0j/PX4fFwFbECY/hQFB:ZPTjGktzS5pGOl0TwSbw0B

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2