Extracted

Extracted

• • Target

    f91dc01070735093cbe3f55861a2f645c1c8695f34a9bbc231fcf51e4a03f56eN.exe

  • Size

    1.8MB

  • MD5

    581b90b8649b106611a2857a9d313870

  • SHA1

    0ba855743164baaa410a7e536a8a568dbbd314e8

  • SHA256

    f91dc01070735093cbe3f55861a2f645c1c8695f34a9bbc231fcf51e4a03f56e

  • SHA512

    2c1764cc6f1b71178bb3deaedb8e50bdd9ebd99293640dd9ccca67daf8b71566b501e7eff133ade7ae989adcd062e24da71c393adb5bde2b23b3ebb92659b985

  • SSDEEP

    49152:zQh5mrU7sMjWrHEjLoiYAOFcMig3eovvsZiLtlAaSV:zAgCyMZxavv5tQ

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2