Extracted

• • Target

    a99e53a5accb9cb44e3b1cba1c06840766a95aa4cf4f9ed96f45967aeae6f18b

  • Size

    3.0MB

  • MD5

    b2da980db31424771fb841af02f82a85

  • SHA1

    19c154935a7fe53460e0d172888b68d812a94ffe

  • SHA256

    a99e53a5accb9cb44e3b1cba1c06840766a95aa4cf4f9ed96f45967aeae6f18b

  • SHA512

    44a1b2bd373c0a400d399084641402e669b553bfd218fd194c988f22d42ecb452a8fa2e01fa8f030ad0e68f8af088a3dfa08390e61c05407820fe6a2b8c11029

  • SSDEEP

    49152:Wo4LbDfCs7wwFqe6n6HwV+OpanCSfFYH1zQiGt6mrXC:WVDqs71qe66HwV+dnpfFYH1ciGt6me

  Score

  10^/10

  lummadefense_evasionstealerdiscovery

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2