ESET has collaborated with Microsoft<\/a>, BitSight<\/a>, Lumen<\/a>, Cloudflare<\/a>, CleanDNS<\/a>, and GMO Registry<\/a> in a worldwide disruption operation in opposition to Lumma Stealer, an notorious malware-as-a-service (MaaS) infostealer. The operation focused Lumma Stealer infrastructure with all recognized C&C servers up to now yr, rendering the exfiltration community, or a big a part of it, nonoperational.<\/p>\n

\n
Key factors of this blogpost:<\/strong><\/p>\n
\n
ESET took half in a coordinated world operation to disrupt Lumma Stealer.<\/li>\n
ESET offered technical evaluation and statistical info, and extracted important information from tens of 1000’s of malware samples.<\/li>\n
We offer an outline of the Lumma Stealer MaaS ecosystem.<\/li>\n
We additionally present technical evaluation and an outline of the evolution of Lumma Stealer\u2019s key static and dynamic properties, which have been vital to the disruption effort.<\/li>\n<\/ul>\n<\/blockquote>\n
Disruption contribution<\/h2>\n
ESET automated techniques processed tens of 1000’s of Lumma Stealer samples, dissecting them to extract key components, resembling C&C servers and affiliate identifiers. This allowed us to repeatedly monitor Lumma Stealer\u2019s exercise, monitor growth updates, cluster associates, and extra.<\/p>\n
Infostealer malware households, like Lumma Stealer, are sometimes only a foreshadowing of a future, way more devastating assault. Harvested credentials are a valued commodity within the cybercrime underground, offered by preliminary entry brokers to varied different cybercriminals, together with ransomware associates. Lumma Stealer has been one of the crucial prevalent infostealers over the previous two years, and ESET telemetry (see Determine 1) confirms that it has left no a part of the world untouched.<\/p>\n
$\"Figure$
Determine 1. Lumma Stealer detection fee (information since July 2024)<\/em><\/figcaption><\/figure>\n
Lumma Stealer builders had been actively creating and sustaining their malware. We have now recurrently observed code updates starting from minor bug fixes to finish alternative of string encryption algorithms and adjustments to the community protocol. The operators additionally actively maintained the shared exfiltration community infrastructure. Between June 17^{th<\/sup>, 2024 and Might 1^{st<\/sup>, 2025, we noticed a complete of three,353 distinctive C&C domains, averaging roughly 74 new domains rising every week together with occasional updates to Telegram-based dead-drop resolvers (see Determine 2). We focus on the main points of the community infrastructure later within the blogpost.<\/p>\n}}
$\"Figure$
Determine 2. Weekly counts of latest C&C domains<\/em><\/figcaption><\/figure>\n
This ongoing evolution underscores the numerous menace posed by Lumma Stealer and highlights the significance and complexity of the disruption effort.<\/p>\n
Background<\/h2>\n
Over the previous two years, Lumma Stealer (often known as LummaC or LummaC2<\/a>) has emerged as one of the crucial energetic infostealers within the cybercrime ecosystem, changing into a well-liked device amongst cybercriminals resulting from its energetic growth of malware options and its infrastructure being offered as a service.<\/p>\n
Malware as a service<\/h3>\n
Lumma Stealer adopts the idea of malware as a service (MaaS), the place associates pay a month-to-month payment, primarily based on their tier, to obtain the most recent malware builds and the community infrastructure needed for information exfiltration. Associates have entry to a administration panel with a user-friendly interface the place they will obtain exfiltrated information and harvested credentials.<\/p>\n
The tiered subscription mannequin ranges from USD 250 to USD 1,000 per thirty days, every with more and more subtle options. Decrease tiers embrace fundamental filtering and log obtain choices, whereas greater tiers supply customized information assortment, evasion instruments, and early entry to new options. The costliest plan emphasizes stealth and flexibility, providing distinctive construct technology and decreased detection.<\/p>\n
The operators of Lumma Stealer have additionally created a Telegram market with a score system for associates to promote stolen information with out intermediaries. {The marketplace} has been nicely documented in Cybereason analysis<\/a>. Furthermore, they preserve public documentation of the administration panel for associates and periodically share updates and fixes on hacking boards, as proven in Determine 3.<\/p>\n
$\"Figure$
Determine 3. The official Lumma Stealer documentation \u2013 machine translated from Russian to English (Might 12^{th<\/sup>, 2025)<\/em><\/figcaption><\/figure>\nOpen documentation not solely helps associates with much less expertise to make use of the malware service, but additionally supplies precious insights for safety researchers. Builders deal with malware builds, information pipelining, and infrastructure upkeep, whereas associates are chargeable for distributing the malware. This info, mixed with the service\u2019s reputation, ends in all kinds of compromise vectors.<\/p>\n}Frequent distribution strategies embrace phishing, cracked software program, and different malware downloaders together with SmokeLoader, DarkGate, Amadey, Vidar, and others. Standard phishing schemes contain ClickFix<\/a> or pretend CAPTCHA<\/a> internet pages, fraudulent boards with cracked software program<\/a>, pretend GitHub repositories<\/a>, fraudulent hyperlinks on Reddit boards, and lots of extra.<\/p>\n
Technical evaluation<\/h2>\n
Quite a few public analyses have already been written about Lumma Stealer and its compromise vectors. Our focus right here, nonetheless, is on the points related to the disruption. On this part, we are going to briefly introduce the important thing static and dynamic properties that we’ve got been actively extracting from Lumma Stealer.<\/p>\n
Static properties of Lumma Stealer<\/h3>\n
Numerous info comes embedded in Lumma Stealer malware samples. This naturally presents a really perfect goal for automated extraction. In addition to the plain information of curiosity \u2013 C&C server domains \u2013 the samples additionally include identifier strings that tie the pattern to a selected affiliate and a marketing campaign, and an optionally available identifier resulting in a customized dynamic configuration. These identifiers are utilized in community communication with the C&C server throughout information exfiltration and requests for dynamic configuration. Within the sections beneath, we take a look at these properties in depth.<\/p>\n
C&C domains<\/h4>\n
Every Lumma Stealer pattern comprises a listing of 9 encrypted C&C domains. Whereas the encryption strategies have developed over time, the attribute array construction has remained constant as much as the time of writing.<\/p>\n
Primarily based on Lumma Stealer\u2019s inner pattern versioning, which is closely protected by stack string obfuscation, we all know that up till January 2025, the C&C domains within the samples have been protected by an XOR perform and base64 encoding (see Determine 4). When the base64-encoded string was decoded, it revealed a construction the place the primary 32 bytes served as an XOR key, and the remaining bytes contained the encrypted C&C area.<\/p>\n
$\"Figure$
Determine 4. Record of XOR-protected and base64-encoded C&C domains<\/em><\/figcaption><\/figure>\n
In January 2025, Lumma Stealer transitioned the safety of the C&C record to ChaCha20 encryption with a single hardcoded key and nonce (see Determine 5). This safety of the C&C record within the Lumma Stealer binaries has remained the identical up till the time of publication.<\/p>\n
$\"Figure$
Determine 5. ChaCha20-protected C&C domains<\/em><\/figcaption><\/figure>\nUseless-drop resolvers<\/h4>\n
Since June 2024, every Lumma Stealer construct got here with a brand new function for acquiring a backup C&C. If no C&C server from the static config responds to Lumma Stealer, then the backup C&C is extracted from a dummy Steam profile internet web page performing as a dead-drop resolver<\/a>. The Steam profile URL is closely protected within the binary, the identical approach because the model string. The encrypted backup C&C URL is about within the Steam profile identify, as proven in Determine 6, and the safety is a straightforward Caesar cipher<\/a> (ROT11).<\/p>\n
$\"Figure$
Determine 6. Steam profile and Telegram channel used as dead-drop resolvers<\/em><\/figcaption><\/figure>\n
In February 2025, Lumma Stealer acquired an replace that included a function for acquiring a brand new, main C&C URL from a Telegram channel dead-drop resolver. The C&C URL is extracted from the Telegram channel\u2019s title area, and it’s protected by the identical algorithm as within the case of the Steam profile dead-drop resolver. The primary distinction within the utilization of the Telegram and Steam profile dead-drop resolvers is that the Telegram possibility is examined first, whereas the Steam profile is used as a final resort if profitable communication has not been established with beforehand obtained C&C servers (Determine 16).<\/p>\n
Furthermore, we consider that the Telegram dead-drop resolver is on the market for greater tier subscriptions. It is because many samples should not have the Telegram URL set, and subsequently the malware skips this technique.<\/p>\n
Lumma Stealer identifier<\/h4>\n
Every Lumma Stealer pattern comprises a singular hardcoded affiliate identifier often known as LID. It’s embedded in plaintext kind and utilized for communication with C&C servers. Up till March 2025, the LID parameter string adopted a structured format, delimited by two dashes (Determine 7). A\u00a0detailed evaluation of the LID affiliate string is offered in an upcoming part.<\/p>\n
$\"Figure$
Determine 7. LID identifier in Lumma Stealer pattern<\/em><\/figcaption><\/figure>\n
Though essentially the most prevalent LID noticed throughout our monitoring begins with the string uz4s1o<\/span>; the second commonest LID, which begins with LPnhqo<\/span>, supplies a greater instance for visualizing typical LID variability. Within the phrase cloud in Determine 8, we current the highest 200 LIDs collected throughout our monitoring, beginning with LPnhqo<\/span>.<\/p>\n
$\"Figure$
Determine 8. Record of the highest 200 LID identifiers starting with the<\/em> LPnhqo<\/span> prefix seen in our telemetry<\/em><\/figcaption><\/figure>\n
Nevertheless, in early March 2025, Lumma Stealer transitioned to utilizing hexadecimal identifiers, referred to internally as UID (see Determine 9).<\/p>\n
$\"Figure$
Determine 9. Comparability of HTTPS POST requests for a dynamic configuration<\/em><\/figcaption><\/figure>\n
Non-obligatory configuration identifier<\/h4>\n
Along with the LID parameter, Lumma Stealer samples can also include an optionally available parameter referred to internally as J. When current, this parameter is in cleartext and formatted as a 32-byte ASCII hex string (see Determine 10). The J parameter is utilized within the C&C request for dynamic configuration with extra definitions for exfiltration. We speak about dynamic configuration in additional element in a following part.<\/p>\n
$\"Figure$
Determine 10. The J parameter in a Lumma Stealer pattern<\/em><\/figcaption><\/figure>\n
If the J parameter is lacking within the Lumma Stealer pattern, an empty string is used within the C&C request and a default configuration is retrieved. Not like LID, the J parameter is never current in Lumma Stealer samples. Nevertheless, it performs an important function when current, because it allows retrieving a dynamic configuration that considerably will increase the stealer\u2019s capabilities, making it a extra versatile exfiltration device for menace actors.<\/p>\n
In March 2025, when the LID parameter was renamed to UID and its format modified, the J parameter was renamed to CID however with no change to its format or perform.<\/p>\n
Evaluation of static properties<\/h3>\n
From our long-term monitoring and statistical evaluation of LID parameters, we consider that the primary phase of the LID identifies the affiliate, whereas the second phase differentiates between campaigns. Primarily based on this assumption you’ll be able to see the highest 200 affiliate identifiers in Determine 11.<\/p>\n
$\"Figure$
Determine 11. Essentially the most steadily seen affiliate identifiers in our telemetry<\/em><\/figcaption><\/figure>\n
Furthermore, we’ve got been in a position to create a visualization of the associates\u2019 actions over the previous yr (see Determine 12). This visualization highlights every week in January 2025. Most of these visualizations have offered us with precious insights into the patterns and behaviors of various menace actors. Moreover, the visualizations reveal a shared, domain-based C&C infrastructure amongst most Lumma Stealer associates. On the identical time, we have been in a position to determine much less steadily used C&C domains, which we suspect have been reserved for greater tier associates or extra necessary campaigns.<\/p>\n
$\"Figure$
Determine 12. Visualization of Lumma Stealer infrastructure utilization (early January 2025 time-frame)<\/em><\/figcaption><\/figure>\n
Dynamic properties of Lumma Stealer<\/h3>\n
Lumma Stealer retrieves a dynamic configuration from the C&C server, which comprises definitions specifying what to scan for exfiltration (see Desk 1). The first focus is on stealing internet browser extension information and databases containing passwords, session cookies, internet looking historical past, and autofill information. In addition to internet browsers, it additionally focuses on stealing information from password managers, VPNs, FTP purchasers, cloud providers, distant desktop purposes, electronic mail purchasers, cryptocurrency wallets, and note-taking purposes.<\/p>\n
Desk 1. Dynamic config\u2019s JSON fields<\/em><\/p>\n\n\n\n\n\n\n\n\n
Key<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
v<\/span><\/td>\n Dynamic config model.<\/td>\n<\/tr>\n
se<\/span><\/td>\n Possibility for taking a screenshot of the sufferer\u2019s machine for exfiltration.<\/td>\n<\/tr>\n
ex<\/span><\/td>\n Record of Chromium-based browser extensions to focus on for exfiltration.
Every entry consists of:
\u00a0\u00b7\u00a0 The extension ID, saved as en<\/span>.
\u00a0\u00b7 \u00a0The extension identify, saved as ez<\/span>.<\/td>\n<\/tr>\n
c<\/span><\/td>\n Definition of recordsdata focused for exfiltration.
Essentially the most attention-grabbing entries are:
\u00a0\u00b7\u00a0 The trail for file scanning, saved as p<\/span>.
\u00a0\u00b7\u00a0 The file extension record filter for exfiltration, saved as m<\/span>.
\u00a0\u00b7\u00a0 The utmost folder scanning depth, saved as d<\/span>.
\u00a0\u00b7\u00a0 The utmost file measurement for exfiltration, saved as fs<\/span>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Despite the fact that we haven\u2019t seen vital adjustments within the default configurations, this function enhances the malware\u2019s potential to carry out focused exfiltration (see Determine 13). A complete overview of the configuration fields has already been nicely documented on this analysis<\/a> by SpyCloud.<\/p>\n
$\"Figure$
Determine 13. Instance of a dynamic config<\/em><\/figcaption><\/figure>\n
The configuration is in JSON format, and it’s downloaded from the C&C server utilizing an HTTPS POST request that features the LID identifier, optionally available J parameter, and a selected hardcoded Person-Agent string.<\/p>\n
The safety of the dynamic configuration has modified a number of instances not too long ago. Previously, it was protected in the identical approach because the static C&C record, by a 32-byte XOR perform and base64 encoding. In March 2025 the safety modified to ChaCha20, the place the important thing and nonce have been prepended to the encrypted configuration.<\/p>\n
The Person-Agent string is necessary to observe, as offering it accurately is important for receiving the dynamic configuration. In April 2025, Lumma Stealer launched an extra layer of obfuscation by encrypting JSON values utilizing an 8-byte XOR perform (see Determine 14).<\/p>\n
$\"Figure$
Determine 14. Dynamic configuration with encryption of some values<\/em><\/figcaption><\/figure>\n
This encrypted variant of the dynamic configuration is delivered when a barely up to date Person-Agent string is specified (see Desk 2).<\/p>\n
Desk 2. Person-Agent variants<\/em><\/p>\n\n\n\n\n\n\n
Person-Agent<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Mozilla\/5.0 (Home windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/11<\/span>9.0.0.0 Safari\/537.36<\/span><\/td>\n Previous Person-Agent string leading to a dynamic configuration variant proven in Determine 13.<\/td>\n<\/tr>\n
Mozilla\/5.0 (Home windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/10<\/span>9.0.0.0 Safari\/537.36<\/span><\/td>\n New Person-Agent string leading to a dynamic configuration variant with encryption of some values (Determine 14).<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
In addition to this dynamic configuration method, Lumma Stealer samples nonetheless include hardcoded directions for exfiltrating recordsdata. These embrace information from purposes resembling Outlook or Thunderbird, Steam account info, and Discord account tokens (see this SpyCloud blogpost<\/a>). This mixture of dynamic and hardcoded configurations ensures that Lumma Stealer can successfully acquire a variety of precious information.<\/p>\n
To summarize all of the static and dynamic adjustments talked about to date, we’ve got created a timeline (Determine 15) highlighting essentially the most vital developments noticed within the Lumma Stealer malware over the previous yr.<\/p>\n
$\"Figure$
Determine 15. Timeline of essentially the most vital updates over the previous yr<\/em><\/figcaption><\/figure>\nC&C communication<\/h3>\n
All through our Lumma Stealer monitoring interval, all extracted C&C domains persistently led to Cloudflare providers, that are utilized to hide Lumma Stealer\u2019s actual C&C infrastructure. Cloudflare providers are additionally employed for C&C servers positioned by way of dead-drop resolvers.<\/p>\n
First, Lumma Stealer must get hold of an energetic C&C server. The mechanism of this alternative is illustrated within the move chart proven in Determine 16.<\/p>\n
$\"Figure$
Determine 16. C&C choice mechanism<\/em><\/figcaption><\/figure>\n
Handshake<\/h4>\n
Though the precise handshake request to the C&C server shouldn’t be current within the newest Lumma Stealer builds, it’s price mentioning as a result of it was a function of our monitoring for a very long time. The handshake request was an HTTPS POST request containing act=dwell<\/span> and a hardcoded Person-Agent. Energetic servers responded with a cleartext okay<\/span> message.<\/p>\n
Configuration request<\/h4>\n
When Lumma Stealer identifies an energetic C&C server, it requests the configuration by way of an HTTPS POST request (Determine 17), which incorporates the LID and J parameters as information. If the J parameter shouldn’t be current within the pattern, Lumma Stealer retrieves the default configuration from the C&C server. This configuration specifies what to scan for exfiltration, permitting the malware to adapt to completely different targets and environments.<\/p>\n
Extra payload execution<\/h4>\n
After Lumma Stealer efficiently exfiltrates delicate information and harvested credentials, it points one ultimate HTTPS POST request to the C&C server \u2013 this time, with an extra sufferer {hardware} ID referred to as hwid<\/span>. This ultimate request retrieves a configuration of an extra payload to be executed on the sufferer\u2019s machine. The payload or a URL to obtain from is a part of that configuration. Observe that such a payload shouldn’t be all the time offered.<\/p>\n
$\"Figure$
Determine 17. Lumma Stealer C&C communication move<\/em><\/figcaption><\/figure>\n
Anti-analysis obfuscation strategies<\/h3>\n
Lumma Stealer employs a number of, however efficient, anti-emulation strategies to make evaluation as difficult as attainable. These strategies are designed to evade detection and hinder the efforts of safety analysts.<\/p>\n
Oblique soar obfuscation<\/h4>\n
One of many main obfuscation strategies utilized by Lumma Stealer is oblique management move flattening, proven in Determine 18. This technique successfully disrupts the code blocks of the features, making it almost unimaginable to maintain monitor of the perform logic. By flattening the management move, the malware obfuscates its operations, complicating the evaluation course of. For an in depth exploration of this method and thorough evaluation of those obfuscation patterns, together with an overview of the answer, you’ll be able to confer with this complete article<\/a> by Mandiant.<\/p>\n
$\"Figure$
Determine 18. Oblique management move obfuscation<\/em><\/figcaption><\/figure>\n
Stack strings<\/h4>\n
One other approach employed by Lumma Stealer is using encrypted stack strings, as illustrated in Determine 19. This technique successfully hides binary information and lots of necessary strings within the Lumma Stealer pattern, making static evaluation of the binary tough. Furthermore, every encrypted string has its personal distinctive mathematical perform for decryption, including one other layer of complexity to the evaluation course of.<\/p>\n
$\"Figure$
Determine 19. Stack string decryption routine<\/em><\/figcaption><\/figure>\nImport API obfuscation<\/h4>\n
In Lumma Stealer, imports are resolved at runtime. Import names are hashed utilizing the FNV-1a algorithm with every construct utilizing a customized offset foundation. As proven in Determine 20, since August 25^{th<\/sup>, 2024, Lumma Stealer additionally obfuscates the FNV hash algorithm parameters through the use of stack strings.<\/p>\n}
$\"Figure$
Determine 20. Stack string obfuscation of hash parameters used for obfuscating imported API names<\/em><\/figcaption><\/figure>\nConclusion<\/h2>\n
This world disruption operation was made attainable by our long-term monitoring of Lumma Stealer, which we’ve got offered an outline of on this blogpost. We have now described the modus operandi of the Lumma Stealer group and its service. Moreover, we’ve got documented the necessary static identifiers and C&C communication in addition to its evolution over the past yr. Lastly, we summarized the important thing obfuscation strategies that make the evaluation of Lumma Stealer difficult.<\/p>\n
The disruption operation, led by Microsoft, goals to grab all recognized Lumma Stealer C&C domains, rendering Lumma Stealer\u2019s exfiltration infrastructure nonfunctional. ESET will proceed to trace different infostealers whereas intently monitoring for Lumma Stealer exercise following this disruption operation.<\/p>\n
\n
For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com<\/a>.\u00a0<\/em><\/div>\n
ESET Analysis gives non-public APT intelligence stories and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence<\/a> web page.<\/em><\/div>\n<\/blockquote>\n
IoCs<\/h2>\n
<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
SHA-1<\/strong><\/td>\n Filename<\/strong><\/td>\n Detection<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
6F94CFAABB19491F2B8E719D74AD032D4BEB3F29<\/span><\/td>\n AcroRd32.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2024-06-27.<\/td>\n<\/tr>\n
C5D3278284666863D7587F1B31B06F407C592AC4<\/span><\/td>\n Notion.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2024-07-14.<\/td>\n<\/tr>\n
5FA1EDC42ABB42D54D98FEE0D282DA453E200E99<\/span><\/td>\n explorer.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2024-08-08.<\/td>\n<\/tr>\n
0D744811CF41606DEB41596119EC7615FFEB0355<\/span><\/td>\n aspnet_regiis.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2024-08-25.<\/td>\n<\/tr>\n
2E3D4C2A7C68DE2DD31A8E0043D9CF7E7E20FDE1<\/span><\/td>\n nslookup.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2024-09-20.<\/td>\n<\/tr>\n
09734D99A278B3CF59FE82E96EE3019067AF2AC5<\/span><\/td>\n nslookup.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2024-10-04.<\/td>\n<\/tr>\n
1435D389C72A5855A5D6655D6299B4D7E78A0127<\/span><\/td>\n BitLockerToGo.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2024-11-09.<\/td>\n<\/tr>\n
2CCCEA9E1990D6BC7755CE5C3B9B0E4C9A8F0B59<\/span><\/td>\n exterior.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2024-12-23.<\/td>\n<\/tr>\n
658550E697D9499DB7821CBBBF59FFD39EB59053<\/span><\/td>\n Wemod-Premium-Unlocker-2025<\/span><\/td>\n MSIL\/GenKryptik.HGWU<\/td>\n Lumma Stealer pattern \u2013 Construct 2025-01-18.<\/td>\n<\/tr>\n
070A001AC12139CC1238017D795A2B43AC52770D<\/span><\/td>\n khykuQw.exe<\/span><\/td>\n Win32\/Kryptik.HYUC<\/td>\n Lumma Stealer pattern \u2013 Construct 2025-02-27.<\/td>\n<\/tr>\n
1FD806B1A0425340704F435CBF916B748801A387<\/span><\/td>\n Begin.exe<\/span><\/td>\n Win64\/Injector.WR<\/td>\n Lumma Stealer pattern \u2013 Construct 2025-03-24.<\/td>\n<\/tr>\n
F4840C887CAAFF0D5E073600AEC7C96099E32030<\/span><\/td>\n loader.exe<\/span><\/td>\n Win64\/Kryptik.FAZ<\/td>\n Lumma Stealer pattern \u2013 Construct 2025-04-15.<\/td>\n<\/tr>\n
8F58C4A16717176DFE3CD531C7E41BEF8CDF6CFE<\/span><\/td>\n Set-up.exe<\/span><\/td>\n Win32\/Spy.Lumma Stealer.B<\/td>\n Lumma Stealer pattern \u2013 Construct 2025-04-23.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/span><\/h3>\n
Community<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IP<\/strong><\/td>\n Area<\/strong><\/td>\n Internet hosting supplier<\/strong><\/td>\n First seen<\/strong><\/td>\n Particulars<\/strong><\/td>\n<\/tr>\n<\/thead>\n
172.67.134[.]100<\/span><\/td>\n cooperatvassquaidmew[.]xyz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.175[.]165<\/span><\/td>\n crisisrottenyjs[.]xyz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.96[.]1<\/span><\/td>\n deadtrainingactioniw[.]xyz<\/span>
tamedgeesy[.]sbs<\/span>
nighetwhisper[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.141[.]43<\/span><\/td>\n exuberanttjdkwo[.]xyz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.96[.]3<\/span><\/td>\n grandcommonyktsju[.]xyz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.92[.]96<\/span><\/td>\n qualificationjdwko[.]xyz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.209[.]200<\/span><\/td>\n sweetcalcutangkdow[.]xyz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.49[.]80<\/span><\/td>\n wordingnatturedowo[.]xyz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.97[.]0<\/span><\/td>\n bigmouthudiop[.]store<\/span>
froytnewqowv[.]store<\/span>
locatedblsoqp[.]store<\/span>
stagedchheiqwo[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201116<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.19[.]156<\/span><\/td>\n callosallsaospz[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201118<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.153[.]40<\/span><\/td>\n indexterityszcoxp[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201118<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.192[.]52<\/span><\/td>\n lariatedzugspd[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201118<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.213[.]85<\/span><\/td>\n liernessfornicsa[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201118<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.137[.]78<\/span><\/td>\n outpointsozp[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201118<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.221[.]214<\/span><\/td>\n shepherdlyopzc[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201118<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.204[.]158<\/span><\/td>\n unseaffarignsk[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201118<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.178[.]194<\/span><\/td>\n upknittsoappz[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201107\u201118<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.97[.]3<\/span><\/td>\n bassizcellskz[.]store<\/span>
byteplusx[.]digital<\/span>
sparkiob[.]digital<\/span>
longitudde[.]digital<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201107<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.47[.]141<\/span><\/td>\n celebratioopz[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201107<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.158[.]159<\/span><\/td>\n complaintsipzzx[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201107<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.204[.]20<\/span><\/td>\n deallerospfosu[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201107<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.35[.]48<\/span><\/td>\n languagedscie[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201107<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.73[.]43<\/span><\/td>\n mennyudosirso[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201107<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.97[.]9<\/span><\/td>\n quialitsuzoxm[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201107<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.166[.]231<\/span><\/td>\n writerospzm[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201107<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.16[.]180<\/span><\/td>\n caffegclasiqwp[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201124<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.146[.]35<\/span><\/td>\n condedqpwqm[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201124<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
N\/A<\/span><\/td>\n evoliutwoqm[.]store<\/span><\/td>\n N\/A<\/td>\n 2024\u201108\u201124<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.96[.]0<\/span><\/td>\n millyscroqwp[.]store<\/span>
stamppreewntnq[.]store<\/span>
advennture[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201124<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.67[.]155<\/span><\/td>\n traineiwnqo[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201108\u201124<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
94.140.14[.]33<\/span><\/td>\n achievenmtynwjq[.]store<\/span>
carrtychaintnyw[.]store<\/span>
chickerkuso[.]store<\/span>
metallygaricwo[.]store<\/span>
milldymarskwom[.]store<\/span>
opponnentduei[.]store<\/span>
puredoffustow[.]store<\/span>
quotamkdsdqo[.]store<\/span>
bemuzzeki[.]sbs<\/span>
exemplarou[.]sbs<\/span>
exilepolsiy[.]sbs<\/span>
frizzettei[.]sbs<\/span>
invinjurhey[.]sbs<\/span>
isoplethui[.]sbs<\/span>
laddyirekyi[.]sbs<\/span>
wickedneatr[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201109\u201121<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.97[.]4<\/span><\/td>\n usseorganizedw[.]store<\/span>
bellflamre[.]click on<\/span>
tripfflux[.]world<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201109\u201124<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.44[.]84<\/span><\/td>\n beerishint[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201110\u201106<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.64[.]84<\/span><\/td>\n 1212tank.activitydmy[.]icu<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201111\u201112<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.93[.]246<\/span><\/td>\n brownieyuz[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201111\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.189[.]210<\/span><\/td>\n ducksringjk[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201111\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.146[.]64<\/span><\/td>\n explainvees[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201111\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.90[.]226<\/span><\/td>\n relalingj[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201111\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.14[.]17<\/span><\/td>\n repostebhu[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201111\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.192[.]43<\/span><\/td>\n rottieud[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201111\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.97[.]1<\/span><\/td>\n thinkyyokej[.]sbs<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201111\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.97[.]7<\/span><\/td>\n bashfulacid[.]lat<\/span>
tentabatte[.]lat<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201112\u201123<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.86[.]54<\/span><\/td>\n curverpluch[.]lat<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201112\u201123<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.66[.]86<\/span><\/td>\n lev\u2011tolstoi[.]com<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201112\u201117<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.64.80[.]1<\/span><\/td>\n manyrestro[.]lat<\/span>
toppyneedus[.]biz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201112\u201123<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.97[.]2<\/span><\/td>\n shapestickyr[.]lat<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201112\u201123<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.192[.]247<\/span><\/td>\n slipperyloo[.]lat<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201112\u201123<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.105.90[.]131<\/span><\/td>\n steamcommunity[.]com<\/span>
steamcommunity[.]com<\/span><\/td>\n Akamai Applied sciences, Inc.<\/td>\n 2024\u201106\u201127<\/td>\n Steam profile useless\u2011drop resolvers.<\/td>\n<\/tr>\n
172.67.146[.]68<\/span><\/td>\n talkynicer[.]lat<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201112\u201123<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.184[.]241<\/span><\/td>\n wordyfindy[.]lat<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2024\u201112\u201123<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
N\/A<\/span><\/td>\n beevasyeip[.]bond<\/span><\/td>\n N\/A<\/td>\n 2025\u201101\u201122<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
N\/A<\/span><\/td>\n broadecatez[.]bond<\/span><\/td>\n N\/A<\/td>\n 2025\u201101\u201122<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
N\/A<\/span><\/td>\n encirelk[.]cyou<\/span><\/td>\n N\/A<\/td>\n 2025\u201101\u201128<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
N\/A<\/span><\/td>\n granystearr[.]bond<\/span><\/td>\n N\/A<\/td>\n 2025\u201101\u201122<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
N\/A<\/span><\/td>\n quarrelepek[.]bond<\/span><\/td>\n N\/A<\/td>\n 2025\u201101\u201122<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
N\/A<\/span><\/td>\n rockemineu[.]bond<\/span><\/td>\n N\/A<\/td>\n 2025\u201101\u201128<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.19[.]91<\/span><\/td>\n suggestyuoz[.]biz<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201101\u201122<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
N\/A<\/span><\/td>\n tranuqlekper[.]bond<\/span><\/td>\n N\/A<\/td>\n 2025\u201101\u201122<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.69[.]194<\/span><\/td>\n codxefusion[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201102\u201128<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.80[.]1<\/span><\/td>\n earthsymphzony[.]right this moment<\/span>
climatologfy[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201102\u201126<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.88[.]16<\/span><\/td>\n experimentalideas[.]right this moment<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201101<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.146[.]181<\/span><\/td>\n gadgethgfub[.]icu<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201101<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.48[.]238<\/span><\/td>\n hardrwarehaven[.]run<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201102\u201128<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.16[.]1<\/span><\/td>\n hardswarehub[.]right this moment<\/span>
pixtreev[.]run<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201102\u201128<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.39[.]95<\/span><\/td>\n quietswtreams[.]life<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201102\u201126<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.222[.]46<\/span><\/td>\n socialsscesforum[.]icu<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201103<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.191[.]187<\/span><\/td>\n techmindzs[.]dwell<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201101<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.214[.]226<\/span><\/td>\n techspherxe[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201101<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.26[.]124<\/span><\/td>\n appgridn[.]dwell<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201124<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.178[.]7<\/span><\/td>\n lunoxorn[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201131<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.47[.]117<\/span><\/td>\n skynetxc[.]dwell<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201124<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.72[.]121<\/span><\/td>\n targett[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201120<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
188.114.96[.]2<\/span><\/td>\n travewlio[.]store<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201103\u201120<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.42[.]7<\/span><\/td>\n changeaie[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.85[.]126<\/span><\/td>\n clarmodq[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.161[.]40<\/span><\/td>\n liftally[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.176[.]107<\/span><\/td>\n piratetwrath[.]run<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201117<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.215[.]114<\/span><\/td>\n quilltayle[.]dwell<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201117<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.143[.]12<\/span><\/td>\n salaccgfa[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.5[.]146<\/span><\/td>\n starofliught[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201117<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.32[.]1<\/span><\/td>\n zestmodp[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201108<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.147[.]123<\/span><\/td>\n equatorf[.]run<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201121<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.112[.]1<\/span><\/td>\n hemispherexz[.]high<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201121<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
104.21.20[.]106<\/span><\/td>\n latitudert[.]dwell<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201121<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n
172.67.216[.]12<\/span><\/td>\n sectorecoo[.]dwell<\/span><\/td>\n Cloudflare, Inc.<\/td>\n 2025\u201104\u201119<\/td>\n Lumma Stealer C&C server.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
MITRE ATT&CK strategies<\/h2>\n
This desk was constructed utilizing model 17<\/a> of the MITRE ATT&CK framework.<\/strong><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Tactic<\/strong><\/td>\n ID<\/strong><\/td>\n Title<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Useful resource Improvement<\/strong><\/td>\n T1587.001<\/a><\/td>\n Develop Capabilities: Malware<\/td>\n Lumma Stealer operators actively developed their malware as a product for his or her service.<\/td>\n<\/tr>\n
T1583.001<\/a><\/td>\n Purchase Infrastructure: Domains<\/td>\n Lumma Stealer operators registered domains for his or her exfiltration infrastructure.<\/td>\n<\/tr>\n
T1583.006<\/a><\/td>\n Purchase Infrastructure: Net Companies<\/td>\n Lumma Stealer operators used Cloudflare providers to cover their infrastructure. Lumma Stealer additionally hid its C&C URLs in public providers like dummy Steam profiles or empty Telegram channels.<\/td>\n<\/tr>\n
Execution<\/strong><\/td>\n T1059.003<\/a><\/td>\n Command-Line Interface: Home windows Command Shell<\/td>\n Lumma Stealer executes cmd.exe<\/span> to delete non permanent recordsdata.<\/td>\n<\/tr>\n
T1106<\/a><\/td>\n Native API<\/td>\n Lumma Stealer executes a wide range of Home windows APIs, together with VirtualAlloc<\/span>, LoadLibraryA<\/span>, and GetProcAddress<\/span>.<\/td>\n<\/tr>\n
T1204.001<\/a><\/td>\n Person Execution: Malicious Hyperlink<\/td>\n Lumma Stealer operators supply a easy LNK packing function for his or her malware builds.<\/td>\n<\/tr>\n
T1047<\/a><\/td>\n Home windows Administration Instrumentation<\/td>\n Lumma Stealer makes use of WMI queries to collect system info.<\/td>\n<\/tr>\n
Protection Evasion<\/strong><\/td>\n T1622<\/a><\/td>\n Debugger Evasion<\/td>\n Lumma Stealer checks for debugger presence.<\/td>\n<\/tr>\n
T1140<\/a><\/td>\n Deobfuscate\/Decode Recordsdata or Info<\/td>\n Lumma Stealer makes use of ChaCha20 for C&C record and dynamic config encryption.<\/td>\n<\/tr>\n
T1027.007<\/a><\/td>\n Obfuscated Recordsdata or Info: Dynamic API Decision<\/td>\n Lumma Stealer resolves API names at runtime utilizing the FNV-1a hash algorithm.<\/td>\n<\/tr>\n
T1027.013<\/a><\/td>\n Obfuscated Recordsdata or Info: Encrypted\/Encoded File<\/td>\n Lumma Stealer encrypts strings and necessary binary information utilizing stack strings or ChaCha20.<\/td>\n<\/tr>\n
Credential Entry<\/strong><\/td>\n T1555.003<\/a><\/td>\n Credentials from Password Shops: Credentials from Net Browsers<\/td>\n Lumma Stealer gathers credentials from a number of browsers.<\/td>\n<\/tr>\n
T1539<\/a><\/td>\n Steal Net Session Cookie<\/td>\n Lumma Stealer gathers cookies from a number of browsers.<\/td>\n<\/tr>\n
Discovery<\/strong><\/td>\n T1217<\/a><\/td>\n Browser Bookmark Discovery<\/td>\n Lumma Stealer checks and collects varied details about put in browsers on victims\u2019 machines.<\/td>\n<\/tr>\n
T1012<\/a><\/td>\n Question Registry<\/td>\n Lumma Stealer queries registry keys to record put in software program on victims\u2019 machines.<\/td>\n<\/tr>\n
T1057<\/a><\/td>\n Course of Discovery<\/td>\n Lumma Stealer sends the method record to its C&C server.<\/td>\n<\/tr>\n
T1518<\/a><\/td>\n Software program Discovery<\/td>\n Lumma Stealer sends a listing of put in software program to its C&C server.<\/td>\n<\/tr>\n
T1082<\/a><\/td>\n System Info Discovery<\/td>\n Lumma Stealer sends system info to its C&C server.<\/td>\n<\/tr>\n
T1124<\/a><\/td>\n System Time Discovery<\/td>\n Lumma Stealer sends the present system time and time zone to its C&C server.<\/td>\n<\/tr>\n
Assortment<\/strong><\/td>\n T1560<\/a><\/td>\n Archive Collected Information<\/td>\n Lumma Stealer compresses gathered information earlier than exfiltration to its C&C server.<\/td>\n<\/tr>\n
T1119<\/a><\/td>\n Automated Assortment<\/td>\n Lumma Stealer’s exfiltration capabilities are absolutely automated and primarily based on a configuration file.<\/td>\n<\/tr>\n
T1113<\/a><\/td>\n Display Seize<\/td>\n Lumma Stealer takes screenshots of victims\u2019 machines primarily based on dynamic configuration.<\/td>\n<\/tr>\n
T1005<\/a><\/td>\n Information from Native System<\/td>\n Lumma Stealer collects native system information from victims\u2019 machines.<\/td>\n<\/tr>\n
Command and Management<\/strong><\/td>\n T1071.001<\/a><\/td>\n Software Layer Protocol: Net Protocols<\/td>\n Lumma Stealer makes use of HTTPS communication with its C&C servers.<\/td>\n<\/tr>\n
T1132.001<\/a><\/td>\n Information Encoding: Normal Encoding<\/td>\n Lumma Stealer used base64 encoding for acquiring its configuration from the C&C server.<\/td>\n<\/tr>\n
T1573.001<\/a><\/td>\n Encrypted Channel: Symmetric Cryptography<\/td>\n Lumma Stealer makes use of extra ChaCha20 encryption below the HTTPS community protocol.<\/td>\n<\/tr>\n
T1008<\/a><\/td>\n Fallback Channels<\/td>\n Lumma Stealer employs backup dead-drop resolvers in Steam profiles and Telegram channels.<\/td>\n<\/tr>\n
T1102.001<\/a><\/td>\n Net Service: Useless Drop Resolver<\/td>\n Lumma Stealer employs backup dead-drop resolvers in Steam profiles and Telegram channels.<\/td>\n<\/tr>\n
Exfiltration<\/strong><\/td>\n T1020<\/a><\/td>\n Automated Exfiltration<\/td>\n Lumma Stealer exfiltrates stolen credentials and information over the C&C channel.<\/td>\n<\/tr>\n
T1041<\/a><\/td>\n Exfiltration Over C2 Channel<\/td>\n Lumma Stealer exfiltrates stolen credentials and information over the C&C channel.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
$\"\"$ <\/a><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"
ESET has collaborated with Microsoft, BitSight, Lumen, Cloudflare, CleanDNS, and GMO Registry in a worldwide disruption operation in opposition to Lumma Stealer, an notorious malware-as-a-service (MaaS) infostealer. The operation focused Lumma Stealer infrastructure with all recognized C&C servers up to now yr, rendering the exfiltration community, or a big a part of it, nonoperational. Key […]<\/p>\n","protected":false},"author":2,"featured_media":3244,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[3080,679,3079,2255,2130,668,2256,595],"class_list":["post-3242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-disrupt","tag-eset","tag-global","tag-lumma","tag-operation","tag-part","tag-stealer","tag-takes"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/3242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3242"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/3242\/revisions"}],"predecessor-version":[{"id":3243,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/3242\/revisions\/3243"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/3244"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Anti-analysis obfuscation strategies<\/h3>\nLumma Stealer employs a number of, however efficient, anti-emulation strategies to make evaluation as difficult as attainable. These strategies are designed to evade detection and hinder the efforts of safety analysts.<\/p>\n

IoCs<\/h2>\n

Anti-analysis obfuscation strategies<\/h3>\n
Lumma Stealer employs a number of, however efficient, anti-emulation strategies to make evaluation as difficult as attainable. These strategies are designed to evade detection and hinder the efforts of safety analysts.<\/p>\n