Extracted

Extracted

• • Target

    4e5951866d4ca4fdd5e76ace99b49d8d92f13c28289b78d3989957069bc1799a.exe

  • Size

    1.8MB

  • MD5

    e4b5250f65686e87e82210c71f5d5870

  • SHA1

    2c9d0de98a7cbcf69d6cb496ed85bece6aa2e3f1

  • SHA256

    4e5951866d4ca4fdd5e76ace99b49d8d92f13c28289b78d3989957069bc1799a

  • SHA512

    80c6e789bdedc6a95aa47e65e0fab15c1d3bfec3daf8c79629b60296e8b508421a55e9e978689cb9f661f0702c56c2ed3f7f59ab722eec9241aac1903d438b92

  • SSDEEP

    49152:0r3QQ4F6pS1kEzvlwHHVkSRZcMbe4mT71OrUF:kQQ/Ezvl6eKVrU

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2