Extracted

Extracted

• • Target

    6896d4a208e14bdc55e9eea19b8444e342cfb2d9959cc93f65b3d5fee398c304.exe

  • Size

    1.8MB

  • MD5

    bce9e8eabe97a082a42366988424ae91

  • SHA1

    45faa483f9c702fcf34b4fd566f18c8f499b7564

  • SHA256

    6896d4a208e14bdc55e9eea19b8444e342cfb2d9959cc93f65b3d5fee398c304

  • SHA512

    beb3e1a742f943fffa70137ede65034f3e1ccdae51afe0fdc3c787e8e3a54bd698bff6fef7093addb643b82ecde0f39aaca4a081c7811ebb5afdd7a47f4d936e

  • SSDEEP

    49152:16DWDtxKkkv6hjdsbLd4sE6+UnD3XkGXodKSS:Bj26pO19lDHkGnS

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2