Extracted

• • Target

    Sigmanly_39cf6f9ee572a1b88a008fee671033e8f12e9fd3acae3bcc8d396ccef4d8b5be

  • Size

    2.8MB

  • MD5

    3d433b38ddd7681112b41ac5d55e0e50

  • SHA1

    b6e2898e0bfe4dd14c1aaf35408436baea062815

  • SHA256

    39cf6f9ee572a1b88a008fee671033e8f12e9fd3acae3bcc8d396ccef4d8b5be

  • SHA512

    dd3c8512d745bae07da4075e6871a4136c69a6fb95ca3be5e3c81e13e311f15086cebc3e992043d7bea171066f71adaa3218fed6d7b1221305d613b65310ef5c

  • SSDEEP

    49152:jlyQnLvsMFBXjtElACNNQbcjLjkzy+YALjSTxbnyhRXHEOmDbLWme98nJv:vLv1zTtEtH39SRUlLWmB

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2