Extracted

• • Target

    42107cd2b3f3ce2c36c79c5932dd3be5d457cc63e091a2fceba26edd523289d0.exe

  • Size

    1.8MB

  • MD5

    3302c048322cc255bca09357e814ff78

  • SHA1

    1da8fd41a4108d663e0bdce1c2f6332e020b3522

  • SHA256

    42107cd2b3f3ce2c36c79c5932dd3be5d457cc63e091a2fceba26edd523289d0

  • SHA512

    0ddec1ed98f8e1f8ea7996966ed5e501ff677aa6bead6e6fa8f222f81fb7e957950ec5ed5e8bb4d1b166b069c0b947ff455dd737ba52024953c045dad309fc64

  • SSDEEP

    49152:LXZjzUet62VHpj72RJaglAzI7dFWcobrkxOYhXsXnNcp:LXZjAeBlB72R0I7PyrkxOYh8XKp

  Score

  10^/10

  lummaevasionstealerdiscovery

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2