Extracted

• • Target

    5a5e9b3d4dbb4fe8e6e740e31728677a344e933438438986bebb07d00151b3cb.exe

  • Size

    1.8MB

  • MD5

    ad4e0c695b7eaf90c933a8ea8bf25590

  • SHA1

    9998082e31bbece6a9d1efa148388a4f017096fa

  • SHA256

    5a5e9b3d4dbb4fe8e6e740e31728677a344e933438438986bebb07d00151b3cb

  • SHA512

    6026c2bcdee7f9540c50573e672feaca956ba2801606bdce24d7b219513f91bc6cddf6b9a8df5ed479aec14c05dcda6f230ceaca0cccdd67891e8253366064a8

  • SSDEEP

    49152:YAp9rgVXN3xcAoW4r7aJf1xTZUgWz4lv6:YO90xNeAoWa7aJ3FUguy

  Score

  10^/10

  lummadefense_evasiondiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2