Extracted

Extracted

• • Target

    5cdcb46bbed0d871117367be37dad2911be7dc49e72c6b1a3b23d155e8e1e43eN.exe

  • Size

    2.8MB

  • MD5

    2dd5da9914738859f664e5efad45bad0

  • SHA1

    722849c8ebf78c7d1bd9b636784e57dda8338d79

  • SHA256

    5cdcb46bbed0d871117367be37dad2911be7dc49e72c6b1a3b23d155e8e1e43e

  • SHA512

    2198479243ef0daed0600040e07bbaf7febb6a30b5da5f0ffe788489b3a9b93eddd061789b1e5749e086dab0020c1bed7e59b2179603285fd910faf5b64a75fc

  • SSDEEP

    49152:LL3opr2ykWg2bXTmYQTTl8hg26ygW45wpNlOpdl3jn:L7i2ykWg2jaYgChg26ygWnNadjn

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2