Extracted

• • Target

    Sigmanly_1ccc25a2eec0055dd54067e9f1171d23ebd1b76943c001b0e8cb9142efa2e94f

  • Size

    2.9MB

  • MD5

    7c40df7c925b4162cf9bf069b6de8e1b

  • SHA1

    a02ad3e26c014a6524977b0aed92cfa5cf34ad46

  • SHA256

    1ccc25a2eec0055dd54067e9f1171d23ebd1b76943c001b0e8cb9142efa2e94f

  • SHA512

    4f0987617b51f3d55bc2bf1a0c07d1b4631a1a3d018ade0824638422a5c942c4fe28aa38e44b7118f6cae319886e1fa9d8ed915a2adbe6d29d28a73a0de010e2

  • SSDEEP

    49152:ax4BXtK8dAmA94M53LlKHIkwS0WlHkQPttTeEaMT:Jo8dhA94M53LNknvz

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2