Extracted

• • Target

    random.exe

  • Size

    1.8MB

  • MD5

    8fbccbf956fe2c50d4ba43f3d255826c

  • SHA1

    4a1f6da6c0a1bbd5ddb2dcfeef7c0921464e76b8

  • SHA256

    296a55aeb84508ddcbc7464a96f04a3c3c77c89046eb56b7675a52939d07a94d

  • SHA512

    6efc8875b29d79ad81b6c878e1778f86d7bb9738bbc48d9df323c2e7033b469cd0cfb95fec7472e731f6b03f0aa9efd306a9879f5a9fd6639d56dd6a66621536

  • SSDEEP

    49152:n+K33Fte4EjLQcT2aXWsysEUTA8INulO45AxJQe:n+KnLe4g0OmsrEUTAvYe9

  Score

  10^/10

  lummadefense_evasiondiscoverystealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1