Extracted

• • Target

    Sigmanly_315aee541b7f4d32b0fa71932e9227aa3ef1667856d5dc35c97bf1434e2ae31c

  • Size

    1.8MB

  • MD5

    e17baab743930b14a8d9a54086f091d6

  • SHA1

    7eed52a4f370c7dc47ac8e4a7ea04a16fafd5993

  • SHA256

    315aee541b7f4d32b0fa71932e9227aa3ef1667856d5dc35c97bf1434e2ae31c

  • SHA512

    d6fc974855beacc7b3605ef0c99aac5879be9a208ce69b7af941d715343fbf7be2ab0df5c345c67a2a56f614d3279d1b48be66030e4bf73d454843d8634d2f68

  • SSDEEP

    49152:fAPsGokjs9oS7M9sG3Ve+a1Tn102BcjkDMXp:fSsGoBw9sUVOTn1/uQDM5

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2