Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    5d63d232da2641a215b8f6aedd86116d

  • SHA1

    7a787a1c0889f95fcacfd50a85357edcbae636af

  • SHA256

    76fc39b6dcf7f7e4fe30298a8bc03aa9a175f45fe496926f8372279b8380b4fe

  • SHA512

    8166c4edcb4461ea25ce78f017ce8277abc21227dd873b459842394f1af28a440b55bd2b6386c348a8574183e5846c94eb839d1ec60837ef3dbb3bae784a633a

  • SSDEEP

    49152:nom+AYNvQkppVvxp75OtAHNQdJHRDJ7T:nH+AUXfFntQdLDpT

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2