Extracted

Extracted

• • Target

    ae52efa9c950ed352e0a2a7c324d3938dbba04ba467e3b9fc6b1c89e7711b354.zip

  • Size

    1.8MB

  • MD5

    f127316d036ecf506fa4141b319a3043

  • SHA1

    8b81cd390b5b8769bf5806feb8cb598104866ed4

  • SHA256

    ae52efa9c950ed352e0a2a7c324d3938dbba04ba467e3b9fc6b1c89e7711b354

  • SHA512

    f3f74d4993f511043b6b7819df189e4b75be8b52e2351e9783675202b3d14c4c626d2861cfa0d8e08b888dc206b22d13d5cbbe30e8cc87e467d723e7fca634b5

  • SSDEEP

    24576:cHodoYrZugCKjWk89aFv6HBQENiCEnC9+su8pEfC39ZBg3/+iQLEWFwNgZyqumDm:jOaFiQ14QENXEC99u+Ha2NwsOouZea

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2