Extracted

Extracted

• • Target

    86d07169bd67bb1b8210dd1b8e4aa95e4ca26c38720183547d9640bc79b159a8.exe

  • Size

    1.8MB

  • MD5

    c32551d8daec532a6f470215847dd948

  • SHA1

    422074756656718c86de391fdb26db718b24d690

  • SHA256

    86d07169bd67bb1b8210dd1b8e4aa95e4ca26c38720183547d9640bc79b159a8

  • SHA512

    aa930f48deb04c7c70a14c6a5d4c62deb1f25f09a81b0e7edc012659200692ad199d16d25ea13f07c91781b48e02981dad7d1754fe63998e01b2886f2b4e5c6f

  • SSDEEP

    49152:l2ent7RrjjE7bi3OL20AC2t3zWNTicTDPo:l2K/jj5OL20Utj2/A

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2