Extracted

Extracted

• • Target

    0419321447abb2012698b519a851f6ce4ad90dcedd457f8e7fe9c5b64af07fcc.exe

  • Size

    1.8MB

  • MD5

    1ae6f683a54eda849fd92462d37f1937

  • SHA1

    9c98888d6444414719478467a0bcb7467311268f

  • SHA256

    0419321447abb2012698b519a851f6ce4ad90dcedd457f8e7fe9c5b64af07fcc

  • SHA512

    a45a42171982b6e5dfb30e1e30aee8860bb63cbc744eb0e9c8ca3f795a47d27c1a43e86a42e3520318bc3ff47abaed603f1634d0cde7af90fa258ae57698bc04

  • SSDEEP

    49152:PqKo2Ciix2uPmCKj65OgpCbJwhNOM0XDUwW:CnGw2/CM65Ozb0NOTIF

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2