Extracted

• • Target

    Sigmanly_1b7cdc9c01de521674db6bc4f5ef66d4666d084cf197b8adec56bc431992c253

  • Size

    1.7MB

  • MD5

    e58e6e26d4ff748bd8e7f718372f8351

  • SHA1

    5ec62018f2c5e2f7b91be03fa1c022ad3368cab8

  • SHA256

    1b7cdc9c01de521674db6bc4f5ef66d4666d084cf197b8adec56bc431992c253

  • SHA512

    f098d80f905726d009755079106940a9eb55c8ff824c3fc4770c11f4cc86be0d1b77fd2a857eab15e9791f29a86ffd7b3d7fdebf9d5a84c7ef9e117f6c690abe

  • SSDEEP

    49152:SrOGXYh1FPrUyF6pQ5kHQVxEPjoSLq9gjb9jrXLr:LGXmXrUukHQVu8t9gP9jr7

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2