Procedure examples

Lumma Stealer has used SmartAssembly to obfuscate .NET payloads.

Lumma Stealer has used AES-encrypted payloads contained within PowerShell scripts.

Lumma Stealer has used payloads that resemble benign file extensions such as .mp3, .accdb, and .pub, though the files contained malicious JavaScript content.

Lumma Stealer has exfiltrated collected data over existing HTTP and HTTPS C2 channels.

Lumma Stealer has used process hollowing leveraging a legitimate program such as “BitLockerToGo.exe” to inject a malicious payload.

Lumma Stealer has used PowerShell for initial user execution and other fuctions.

Lumma Stealer has used malicious Python scripts to execute payloads.

Lumma Stealer has utilized AutoIt malware scripts and AutoIt executables.

Lumma Stealer has used HTTP and HTTP for command and control communication.

Lumma Stealer has configured a custom user data directory such as a folder within `%USERPROFILE%\AppData\Roaming` for staging data.

Lumma Stealer has gathered various system information from victim machines.

Lumma Stealer has taken screenshots of victim machines.

Lumma Stealer has automated collection of various information including cryptocurrency wallet details.

Lumma Stealer has used Base64-encoded content during execution, decoded via PowerShell.

Lumma Stealer has installed a malicious browser extension to target Google Chrome, Microsoft Edge, Opera and Brave browsers for the purpose of stealing data.

Lumma Stealer has been delivered through cracked software downloads.

Lumma Stealer has been distributed through a fake CAPTCHA that presents instructions to the victim to open Windows Run window (“Windows Button + R”) and paste clipboard contents (“CTRL + V”) and press “Enter” to execute a Base64-encoded PowerShell.

Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files.

Lumma Stealer has identified and gathered information from two-factor authentication extensions for multiple browsers.

Lumma Stealer has used mshta.exe to execute additional content.

Lumma Stealer as leveraged Electron Applications to disable GPU sandboxing to avoid detection by security software.

Lumma Stealer has queried system resources on the victim device to identify if it is executing in a sandbox or virtualized environments, checking usernames, conducting WMI queries for system details, checking for files commonly found in virtualized environments, searching system services, and inspecting process names. Lumma Stealer has checked system GPU configurations for sandbox detection.

Lumma Stealer has detected antivirus processes using commands such as “tasklist” and “findstr.”

Lumma Stealer has harvested cookies from various browsers.

Lumma Stealer has created registry keys to maintain persistence using `HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.

Lumma Stealer has used valid code signing digital certificates from ConsolHQ LTD and Verandah Green Limited to appear legitimate.

Lumma Stealer has gathered credential and other information from multiple browsers.

Lumma Stealer has utilized the .NET `ProcessStartInfo` class features to prevent the process from creating a visible window through setting the `CreateNoWindow` setting to “True,” which allows the executed command or script to run without displaying a command prompt window.

Lumma Stealer has been delivered through phishing emails with malicious attachments.

Lumma Stealer has been delivered through phishing emails containing malicious links.

Lumma Stealer has used HTTPS for command and control purposes.

Lumma Stealer has leveraged legitimate applications to then side-load malicious DLLs during execution.

Lumma Stealer has used reflective loading techniques to load content into memory during execution.

Lumma Stealer has checked for debugger strings by invoking `GetForegroundWindow` and looks for strings containing “x32dbg”, “x64dbg”, “windbg”, “ollydbg”, “dnspy”, “immunity debugger”, “hyperdbg”, “debug”, “debugger”, “cheat engine”, “cheatengine” and “ida”.

Lumma Stealer has attempted to bypass Windows Antimalware Scan Interface (AMSI) by removing the string “AmsiScanBuffer” from the “clr.dll” module in memory to prevent it from being called.