Extracted

• • Target

    c7597d4e3e3e7822a41bbb7905d1a86ef1eba9b7f9a8eb713a3476940685391a.exe

  • Size

    1.8MB

  • MD5

    7bbab610747ddb6bebdf67eed3bfa912

  • SHA1

    36b5d1bbfdd2ae476feb6931c25b3664bb6df44f

  • SHA256

    c7597d4e3e3e7822a41bbb7905d1a86ef1eba9b7f9a8eb713a3476940685391a

  • SHA512

    05b5e2ebc6ac5b69919f94082997b1891dae2a4faa3c9046151b989cb6565af20751ddccf3e54495170eb89c91b7a018606c547d7215b22386dbee31cf8c01d9

  • SSDEEP

    49152:57qBbf+wIVJK33+NQAISbPYOh0IK+I5vC4u1BeDp4XKI6GsZK99D:0Bbfr8KIQABPYOhDT+ZVc99D

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2