Extracted

• • Target

    9aa48d18906e831bc02922b7a1989a717bd00564be908d5f280e61376e08a7ffN.exe

  • Size

    1.8MB

  • MD5

    64e0121a7510ba647d961bfdcf19a620

  • SHA1

    02004ee15940159b12cc5b3269713a7f31c11f07

  • SHA256

    9aa48d18906e831bc02922b7a1989a717bd00564be908d5f280e61376e08a7ff

  • SHA512

    4454080e3b17680e53807afd3e420bf2f9b28ec9d8e3c76f064e42b757d814699185114b2c1fea904ab7e9becdece678322c4ee142a8135adcc27afcbd549347

  • SSDEEP

    49152:LXZjzUet62VHpj72RJaglAzI7dFWcobrkxOYhXsXnNc:LXZjAeBlB72R0I7PyrkxOYh8XK

  Score

  10^/10

  lummaevasionstealerdiscovery

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2