Extracted

• • Target

    random.exe

  • Size

    1.8MB

  • MD5

    5571e106accca71720c054ad4d1e3ff4

  • SHA1

    1af9a3e95a4a3de59ea38f928bcd2084e6ef648d

  • SHA256

    d4eb02894d6fbe29190d8c23468405cbc9c14c243ad82e3db2f7ebccd729ffae

  • SHA512

    58a5706d10ec0ca25d6dace7a34d03504c0687a73d7861cc774ad1f5535ec6591ca8408896b360ca9c5f8d1107d55a55a0e1e01f07b46c2d3d7efe019676d423

  • SSDEEP

    49152:vRtiYr/CRjtgshd6a65sGKXAvWNcRxxn:LLKus7656XQWyxxn

  Score

  10^/10

  lummadefense_evasiondiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2