{ "family": "lumma", "sample_count": 85, "category": "infostealer", "description": "Lumma Stealer (also tracked in threat telemetry as LummaC2, LummaStealer, and Trojan:Win32/Lumma) is a premier C-language information stealer that emerged in late 2022 and rapidly rose to become the dominant stealer framework on the cybercrime underground by 2024. Authored natively in C by a threat actor operating under the alias 'Lumma', the malware was explicitly engineered to optimize execution speed, minimize binary overhead, and withstand modern endpoint detection and response (EDR) heuristics. Lumma is sold under a multi-tier Malware-as-a-Service (MaaS) licensing model, offering tiered access ranging from standard binary builds to corporate enterprise licenses featuring advanced polymorphic crypters and proactive domain rotation. Lumma executes deep credential harvesting across Chromium and Gecko browsers, extracting encrypted DPAPI-protected Master Keys to decrypt stored credentials, session cookies, and autofill vaults offline. It aggressively targets over 70 browser cryptocurrency extensions, desktop Web3 wallets, KeePass password databases, VPN profiles, and multi-factor authentication browser tokens. Lumma is heavily distributed via sophisticated ClearFake and fake-update drive-by campaigns, YouTube video description links promoting AI software lures, Discord CDN distribution, and weaponized archive lures exploiting CVE-2023-38831 and Windows SmartScreen defense evasion flaw CVE-2024-21412. Its C2 infrastructure incorporates high-resilience control protocols: the binary employs multi-layered XOR and AES-string decryption, anti-virtual-machine checks utilizing CPUID and instruction timing, and dynamic C2 communication featuring decoy HTTP POST requests sent to legitimate web services alongside genuine command servers to obstruct network perimeter triage.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "Lumma Stealer", "LummaC2", "LummaStealer", "Trojan:Win32/Lumma", "Win32/LummaStealer", "Lumma.C2" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is Lumma Stealer and why is it so prominent?", "acceptedAnswer": { "@type": "Answer", "text": "Lumma Stealer (LummaC2) is a lightweight, high-performance information stealer written in C. It emerged in 2022 and quickly dominated the MaaS stealer ecosystem due to its aggressive evasion techniques, fast execution, and frequent feature updates." } }, { "@type": "Question", "name": "How does Lumma bypass Windows SmartScreen?", "acceptedAnswer": { "@type": "Answer", "text": "Lumma campaigns heavily weaponized vulnerability CVE-2024-21412, utilizing specially crafted internet shortcut (.url) files pointing to remote WebDAV servers to execute malicious scripts without triggering SmartScreen warning prompts." } }, { "@type": "Question", "name": "What is the ClearFake infection vector associated with Lumma?", "acceptedAnswer": { "@type": "Answer", "text": "ClearFake is a drive-by compromise framework that displays fake web browser update overlays on compromised legitimate websites, convincing victims to download and run malicious installers containing Lumma Stealer." } }, { "@type": "Question", "name": "How does Lumma evade network detection during C2 communication?", "acceptedAnswer": { "@type": "Answer", "text": "Lumma sends decoy HTTP POST requests to legitimate domains alongside requests to active C2 servers. This traffic flooding confuses automated network sandbox analysis and thwarts signature-based intrusion detection." } }, { "@type": "Question", "name": "What types of Web3 and crypto assets does Lumma target?", "acceptedAnswer": { "@type": "Answer", "text": "Lumma targets over 70 cryptocurrency browser extensions (MetaMask, Phantom, Coinbase Wallet) and desktop wallets, extracting wallet databases, local storage files, and keystore records to siphon digital assets." } }, { "@type": "Question", "name": "What defensive measures effectively block Lumma Stealer?", "acceptedAnswer": { "@type": "Answer", "text": "Deploy modern EDR solutions capable of detecting in-memory unhooking and DPAPI master key decryption, apply February 2024 Windows cumulative updates patching CVE-2024-21412, and restrict executable launches from user temporary directories." } }, { "@type": "Question", "name": "How does Lumma Stealer leverage control flow flattening and string XOR encryption to evade static antivirus engines?", "acceptedAnswer": { "@type": "Answer", "text": "Lumma Stealer employs advanced compiler-level control flow flattening, inserting convoluted state machines, bogus switch dispatchers, and dead code blocks to break linear disassembly in reverse-engineering tools like IDA Pro and Ghidra. All critical strings—including API names, targeted browser paths, and C2 parameters—are stored as encrypted byte arrays decoded only in temporary stack buffers via dynamic XOR keys." } }, { "@type": "Question", "name": "What browser extension wallet IDs and 2FA desktop apps does Lumma Stealer prioritize for extraction?", "acceptedAnswer": { "@type": "Answer", "text": "Lumma maintains an extensive targeting dictionary containing over 70 unique Google Chrome extension identifiers corresponding to popular Web3 cryptocurrency wallets (including MetaMask, Phantom, Coinbase Wallet, TronLink, and Binance Wallet). In addition, Lumma searches the victim's filesystem for desktop authenticator applications (such as Authy Desktop) and password managers (Bitwarden, 1Password) to harvest master vault archives." } } ], "faq_count": 8, "mitre_attack": [ "T1555.003", "T1539", "T1005", "T1082", "T1083", "T1071.001", "T1027", "T1497.001", "T1553.005" ], "cisa_advisory": null, "exploited_cves": [ "CVE-2024-21412", "CVE-2023-38831" ], "last_updated": "2026-10-16", "sources": [ { "name": "Outpost24: LummaC2 Stealer Technical In-Depth Dissection", "url": "https://outpost24.com/blog/lummac2-stealer-in-depth-dissection/" }, { "name": "Mandiant Threat Intelligence: The Ascendance of Lumma Stealer", "url": "https://www.mandiant.com/resources/blog/lumma-stealer-threat-analysis" }, { "name": "Trend Micro: ClearFake Drive-By Campaigns Delivering LummaC2", "url": "https://www.trendmicro.com/en_us/research/23/k/clearfake-distributed-malware.html" }, { "name": "Microsoft Threat Intelligence: Detecting Lumma Stealer and SmartScreen Bypasses", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/13/cve-2024-21412-smartscreen-bypass-analysis/" } ], "iocs": { "file_hashes": [ "31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad", "b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025", "9bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a420" ], "delivery": [ "ClearFake drive-by compromise injecting fake browser update overlays on compromised WordPress sites", "Malicious internet shortcuts (.url) exploiting Windows SmartScreen defense evasion vulnerability CVE-2024-21412", "Spear-phishing archives with weaponized files exploiting WinRAR vulnerability CVE-2023-38831" ], "persistence": [ "Runs as an ephemeral in-memory payload exiting immediately after exfiltration to evade detection", "Scheduled task execution via schtasks for enterprise-level persistence", "Registry Run key under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ] }, "lineage": { "derived_from": [], "variants": [ "lummac2_v1", "lummac2_v2", "lummac2_v3_decoy_c2", "lumma_corporate_build" ] }, "ecosystem": [ "windows", "windows_pe" ], "attack_stage": [ "initial_access", "execution", "credential_access", "discovery", "collection", "command_and_control", "exfiltration" ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }