Extracted

• • Target

    random.exe

  • Size

    1.8MB

  • MD5

    af9ee9b84f1f16d1ac32e9366f84e464

  • SHA1

    17e3a7bb7c6c95d164a3efa76b0a28f466a26e96

  • SHA256

    3aa8dec61049fdb9001c82cd40f64b1d06e4015440d3cf67b02a134f12e2d028

  • SHA512

    fa1cb7d1a8735ee474b3ef9f3236639ffde80084eea17f233045f96db99f167da37b3557c0cdadac54aec29c9e6305427cfcd30e0ecef63d71aec25d45bd3372

  • SSDEEP

    24576:KyjIH6p5Oc4CLmMZy9v8hIkRmzsDoIpZ2ORT4Uni+IpKko6pkWiXk+NrQW+FFibU:vjIapoc4CLmMYEhI9sD3zzypkWidA

  Score

  10^/10

  lummadefense_evasiondiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2