Extracted

Extracted

• • Target

    e51a10dbcddfcbbba3c22802cb242b90d0c652a7c02b95b2160942a5619d576e.exe

  • Size

    1.8MB

  • MD5

    152d2b0c276bde04f166eed03b955c41

  • SHA1

    ce8f9cf1d522decd5976b935017b9af20444dbed

  • SHA256

    e51a10dbcddfcbbba3c22802cb242b90d0c652a7c02b95b2160942a5619d576e

  • SHA512

    d3fbbf72e6e9db728d122ec4201dbf5ad058ddaf9572ed440bf38b1390048cc9353defd37034a6fcdb3087e1fc1aaa95a9a3c2b270a5bf1e89f241a659d11386

  • SSDEEP

    49152:BlOkMgyU+51/4yFikpIneEVcUTAkgwza:BlOkJe1/4yAn4Uk

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2