Extracted

• • Target

    random.exe

  • Size

    1.8MB

  • MD5

    ef5fe7e1a7ba84be6ea9720d5cc988b8

  • SHA1

    ee22dcd6740655af8367020d4528256def6be199

  • SHA256

    c1aac9177fbabccd0e0b5cf685e492da88dfb117a1a2842963b8ced99792a6fd

  • SHA512

    056824ef48eb377ce9e711958a13f75962adfdf67d1e4761381ef24627d3d44025dfead641bfab9972471d8a8bde3ecce6c44aea268589aea7d23e4b79911025

  • SSDEEP

    49152:SL3i/x5Kim/wGFnowdUnFHSpaqV36gzBWlQ:y3sM/wOnUnF7A3jWq

  Score

  10^/10

  lummadefense_evasiondiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1