Lumma

Overview

Lumma Stealer (also tracked in threat telemetry as LummaC2, LummaStealer, and Trojan:Win32/Lumma) is a premier C-language information stealer that emerged in late 2022 and rapidly rose to become the dominant stealer framework on the cybercrime underground by 2024. Authored natively in C by a threat actor operating under the alias 'Lumma', the malware was explicitly engineered to optimize execution speed, minimize binary overhead, and withstand modern endpoint detection and response (EDR) heuristics. Lumma is sold under a multi-tier Malware-as-a-Service (MaaS) licensing model, offering tiered access ranging from standard binary builds to corporate enterprise licenses featuring advanced polymorphic crypters and proactive domain rotation. Lumma executes deep credential harvesting across Chromium and Gecko browsers, extracting encrypted DPAPI-protected Master Keys to decrypt stored credentials, session cookies, and autofill vaults offline. It aggressively targets over 70 browser cryptocurrency extensions, desktop Web3 wallets, KeePass password databases, VPN profiles, and multi-factor authentication browser tokens. Lumma is heavily distributed via sophisticated ClearFake and fake-update drive-by campaigns, YouTube video description links promoting AI software lures, Discord CDN distribution, and weaponized archive lures exploiting CVE-2023-38831 and Windows SmartScreen defense evasion flaw CVE-2024-21412. Its C2 infrastructure incorporates high-resilience control protocols: the binary employs multi-layered XOR and AES-string decryption, anti-virtual-machine checks utilizing CPUID and instruction timing, and dynamic C2 communication featuring decoy HTTP POST requests sent to legitimate web services alongside genuine command servers to obstruct network perimeter triage.

Known aliases

Threat reports may refer to this family under multiple names:

• Lumma Stealer
• LummaC2
• LummaStealer
• Trojan:Win32/Lumma
• Win32/LummaStealer
• Lumma.C2

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Lummac2_V1 · Lummac2_V2 · Lummac2_V3_Decoy_C2 · Lumma_Corporate_Build

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1555.003 · T1539 · T1005 · T1082 · T1083 · T1071.001 · T1027 · T1497.001 · T1553.005

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2024-21412 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2023-38831 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad
• b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025
• 9bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a420

Delivery vectors

• ClearFake drive-by compromise injecting fake browser update overlays on compromised WordPress sites
• Malicious internet shortcuts (.url) exploiting Windows SmartScreen defense evasion vulnerability CVE-2024-21412
• Spear-phishing archives with weaponized files exploiting WinRAR vulnerability CVE-2023-38831

Persistence mechanisms

• Runs as an ephemeral in-memory payload exiting immediately after exfiltration to evade detection
• Scheduled task execution via schtasks for enterprise-level persistence
• Registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_LUMMA_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lumma"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "lumma" ascii wide nocase
        $s2 = "lumma stealer" ascii wide nocase
        $s3 = "lummac2" ascii wide nocase
        $s4 = "lummastealer" ascii wide nocase
        $s5 = "trojan:win32/lumma" ascii wide nocase
        $s6 = "win32/lummastealer" ascii wide nocase
        $s7 = "lumma.c2" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Lumma (Infostealer) Execution & Triage
id: 774b2585-9f47-5982-a608-cc0972e92f9f
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Lumma malware family. Detects browser credential database harvesting, master
  key queries, and DPAPI extraction routines typical of modern infostealers.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/lumma
- https://malware-families-catalog.systemhelpdesk.com/defensive/infostealer-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.infostealer
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1555_003
- attack.t1539
- attack.t1005
- attack.t1082
- attack.t1083
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \rundll32.exe
    CommandLine|contains:
    - \Google\Chrome\User Data\Default\Login Data
    - \AppData\Roaming\Mozilla\Firefox\Profiles
    - \AppData\Local\Microsoft\Edge\User Data
    - vaultcmd.exe /list
    - dpapi
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_LUMMA_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lumma tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "lumma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

References & External Analysis

• Outpost24: LummaC2 Stealer Technical In-Depth Dissection
• Mandiant Threat Intelligence: The Ascendance of Lumma Stealer
• Trend Micro: ClearFake Drive-By Campaigns Delivering LummaC2
• Microsoft Threat Intelligence: Detecting Lumma Stealer and SmartScreen Bypasses
• Search "lumma" on VirusTotal (External Analysis)
• Search "lumma" on Any.Run (Sandbox Sandbox)
• Search "lumma" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Infostealer)

Explore other documented threats in the same operational category:

• Ldpinch
• Coinstealer
• Mintluks
• Universal1337
• Chisburg
• Yunsip
• Cosmicduke
• Adspy

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/lumma.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.