Fortinet LummaStealer 2024

Lumma Stealer has used SmartAssembly to obfuscate .NET payloads.

Lumma Stealer has exfiltrated collected data over existing HTTP and HTTPS C2 channels.

Lumma Stealer has used PowerShell for initial user execution and other fuctions.

Lumma Stealer has used HTTP and HTTP for command and control communication.

Lumma Stealer has gathered various system information from victim machines.

Lumma Stealer has been delivered through cracked software downloads.

Lumma Stealer has queried system resources on the victim device to identify if it is executing in a sandbox or virtualized environments, checking usernames, conducting WMI queries for system details, checking for files commonly found in virtualized environments, searching system services, and inspecting process names. Lumma Stealer has checked system GPU configurations for sandbox detection.

Lumma Stealer has harvested cookies from various browsers.

Lumma Stealer has gathered credential and other information from multiple browsers.

Lumma Stealer has utilized the .NET `ProcessStartInfo` class features to prevent the process from creating a visible window through setting the `CreateNoWindow` setting to “True,” which allows the executed command or script to run without displaying a command prompt window.

Lumma Stealer has used HTTPS for command and control purposes.

Lumma Stealer has used reflective loading techniques to load content into memory during execution.

Lumma Stealer has checked for debugger strings by invoking `GetForegroundWindow` and looks for strings containing “x32dbg”, “x64dbg”, “windbg”, “ollydbg”, “dnspy”, “immunity debugger”, “hyperdbg”, “debug”, “debugger”, “cheat engine”, “cheatengine” and “ida”.