Extracted

• • Target
    jaffacakes118_43916f36a55840bbd4e8624eb9c9bd73d8b63d0586b32e2b7c290808ffd8c819.bin
  • Size 1.7MB
  • SHA256 43916f36a55840bbd4e8624eb9c9bd73d8b63d0586b32e2b7c290808ffd8c819
  • MD5 a3ae91de3827d7991123db995d52bf58
  • SHA1 337d3ba17cea00dbeec9f8acc09243059c6b56e5
  • SHA512 1a5f175cff0414d1bfa7b57e67a45a31084851898fb977006006fb9c9b71d11f743e701e714cc7daa68fda34328ffcf57aeb344b01485f73f3168503c905d46c
  • SSDEEP 49152:Qe+xff/JXgcGOrpYHx/Xdi3eUxfXQSmvXJKy:QTx/mR/Xd2eUKSyX3
  • TLSH
    T10585332F5C62DDB5F85AF230F9685A26E0A201160F285FF3746E6B55BCE25E3633011E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverylummaspywarestealertrojan

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2