Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    d4aadd87af5fd4945bcbc76ff3d44e06

  • SHA1

    55022b47287c2adef01bf8a5de17d320e3a507df

  • SHA256

    d9afff60a7ef435234176904e6490409c99acd991a9cafe856f59b7e2064b486

  • SHA512

    a89a6d0667d78e02b40f6e20868e7142a1c0866121daf22c1a686264b263b1467e1b4d377266d8a701ea93433fa0cda36307b0eba452e4c5a66c7a76ccdf7984

  • SSDEEP

    49152:MwhhLlUJjfP90moldFa3F9OXZY/O+0Vh2EajWfv:VuJ6lldIXOXZY/O+0Hv

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2