Lumma Stealer

Lumma Stealer has used HTTP and HTTP for command and control communication.^[3][4]

Lumma Stealer has created registry keys to maintain persistence using HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.^[1][2]

Lumma Stealer has used PowerShell for initial user execution and other fuctions.^[3][1][2][4]

Lumma Stealer has gathered credential and other information from multiple browsers.^[1][4][5]

Lumma Stealer has configured a custom user data directory such as a folder within %USERPROFILE%\AppData\Roaming for staging data.^[5]

Lumma Stealer has used HTTPS for command and control purposes.^[4]

Lumma Stealer has utilized the .NET ProcessStartInfo class features to prevent the process from creating a visible window through setting the CreateNoWindow setting to "True," which allows the executed command or script to run without displaying a command prompt window.^[4]

Lumma Stealer has leveraged legitimate applications to then side-load malicious DLLs during execution.^[1]

Lumma Stealer has attempted to bypass Windows Antimalware Scan Interface (AMSI) by removing the string "AmsiScanBuffer" from the "clr.dll" module in memory to prevent it from being called.^[2]

Lumma Stealer has used payloads that resemble benign file extensions such as .mp3, .accdb, and .pub, though the files contained malicious JavaScript content.^[2]

Lumma Stealer has been delivered through phishing emails with malicious attachments.^[1]

Lumma Stealer has used process hollowing leveraging a legitimate program such as "BitLockerToGo.exe" to inject a malicious payload.^[3]

Lumma Stealer has detected antivirus processes using commands such as "tasklist" and "findstr."^[3]

Lumma Stealer has installed a malicious browser extension to target Google Chrome, Microsoft Edge, Opera and Brave browsers for the purpose of stealing data.^[1]

Lumma Stealer has used valid code signing digital certificates from ConsolHQ LTD and Verandah Green Limited to appear legitimate.^[5]

Lumma Stealer has used mshta.exe to execute additional content.^[3][2]

Lumma Stealer has queried system resources on the victim device to identify if it is executing in a sandbox or virtualized environments, checking usernames, conducting WMI queries for system details, checking for files commonly found in virtualized environments, searching system services, and inspecting process names.^[4] Lumma Stealer has checked system GPU configurations for sandbox detection.^[5]