Extracted

• • Target
    file.exe
  • Size 1.8MB
  • SHA256 a33ee6697cdfa2013f95032e1de914fd1426419b79d88f3079cacd5df1aedbeb
  • MD5 87c76ab27889ed92152ecac2abaa6692
  • SHA1 490e4b4f5bb9515d6d7d7623e23e8905a2c35cb0
  • SHA512 1c469a735241b4548357f274a476f63405068b5110201b7b4238c9245c9dd0c998f8ad0543348a834649a35eba54fafa341f1d982576ea97d42a84246fde2b7d
  • SSDEEP 49152:PQZxFmXyHj8kgYgyshMCpIP4dJsgAOGUWHXb:Yreygk/gJhnpIP4dJzIb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2