Extracted

• • Target
    random.exe
  • Size 1.8MB
  • SHA256 c14af7d2ec582bc42e00996d6646c59af2d507ff3c0dad1c04c266490f12805d
  • MD5 4dece9dcf2088ff186c4daa7090c9f76
  • SHA1 7ac603d6d2b745de01d6e3421b95ef84e7d6e449
  • SHA512 1d96c25b3a09b8b94898cc9c48f865a4213ad12993867912766d49b94502cc66cf38b6156e99e772e6e7d3f9eef51d3bb45a1de8d3e191cdbf3c1820dc48afad
  • SSDEEP 49152:6z5oZnKieALUof2twkCxDY2D1UNHCRyLwGe:6z+Ve8+twkWDB1SsyEn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadefense_evasiondiscoveryspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1