Extracted

Extracted

• • Target

    34df64b26f3c69ef710eb56dd0204eaf3c4e083c74c038265a81700e7d07e459.exe

  • Size

    1.8MB

  • MD5

    eebcc9dcc7640b92a0939d1cc2449160

  • SHA1

    2993ca642310a1c6b4f72fef7093aae28eafed53

  • SHA256

    34df64b26f3c69ef710eb56dd0204eaf3c4e083c74c038265a81700e7d07e459

  • SHA512

    1dc304eee1204367af8e33e5338758ac397a015a6eb8a77d9731b20017a7b08c63058281e08d4dcdab7e5ea0984ec7cdc1d4f3bd5a08d46e2c8ae97b9ef99e08

  • SSDEEP

    49152:GYToCYGH+14UyrNOt/HfSFqtyS0DcnUcWeXi:GC7JYt3SfS0YTWey

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2