Extracted

Extracted

• • Target

    00fd88b1eada904e06f23909f142caf6.exe

  • Size

    1.8MB

  • MD5

    00fd88b1eada904e06f23909f142caf6

  • SHA1

    69737b7a01bee4d13924be916482e14ec780bd9f

  • SHA256

    3639435bd811a8f355795a3cef8c0960d6e363efd692a84db1f8e87a3244389a

  • SHA512

    35ccc9d407ab19018eddfad6b6eb57a4671d13247fa505724df127f80e7cbde8df328bbed3eac68bcd98cf4280e5594e1746820d442d634d95fce161af7afbd1

  • SSDEEP

    49152:RalHdTgQPOrz93GnVS2TjzLyQ8waa12HeRBxqbIww:AX0QPOVWVSQzLT8WyeRGbIww

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2