Extracted

• • Target

    Sigmanly_4448ef4ccedffb399427afd699eb2fdfbbdd74da541bf38bce45b2bab2efde42

  • Size

    1.8MB

  • MD5

    d65dfaafd41de8a252a930da84763e79

  • SHA1

    0519330da9c1f922266baddeffd933b3b0a5f705

  • SHA256

    4448ef4ccedffb399427afd699eb2fdfbbdd74da541bf38bce45b2bab2efde42

  • SHA512

    741309e8c5d5d7d2a6e47b886458a8da345fe3387a43288aec7c3543237a82dc7e5d792460f578c0c7bb6500ddd0890f86b2a702ca039749dce7cd70b83dc7a7

  • SSDEEP

    49152:MszFMD2gak5MP6EouEJeMXHSQP9LmCUMNuf2DojGB:MceXDEp+e2f75Nue8G

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2