LummaC2 Stealer Technical Intelligence Dossier

Executive Summary & Threat Architecture

Lumma Stealer (also tracked in threat telemetry as LummaC2, LummaStealer, and Trojan:Win32/Lumma) is a premier C-language information stealer that emerged in late 2022 and rapidly rose to become the dominant stealer framework on the cybercrime underground by 2024. Authored natively in C by a threat actor operating under the alias 'Lumma', the malware was explicitly engineered to optimize execution speed, minimize binary overhead, and withstand modern endpoint detection and response (EDR) heuristics. Lumma is sold under a multi-tier Malware-as-a-Service (MaaS) licensing model, offering tiered access ranging from standard binary builds to corporate enterprise licenses featuring advanced polymorphic crypters and proactive domain rotation. Lumma executes deep credential harvesting across Chromium and Gecko browsers, extracting encrypted DPAPI-protected Master Keys to decrypt stored credentials, session cookies, and autofill vaults offline. It aggressively targets over 70 browser cryptocurrency extensions, desktop Web3 wallets, KeePass password databases, VPN profiles, and multi-factor authentication browser tokens. Lumma is heavily distributed via sophisticated ClearFake and fake-update drive-by campaigns, YouTube video description links promoting AI software lures, Discord CDN distribution, and weaponized archive lures exploiting CVE-2023-38831 and Windows SmartScreen defense evasion flaw CVE-2024-21412. Its C2 infrastructure incorporates high-resilience control protocols: the binary employs multi-layered XOR and AES-string decryption, anti-virtual-machine checks utilizing CPUID and instruction timing, and dynamic C2 communication featuring decoy HTTP POST requests sent to legitimate web services alongside genuine command servers to obstruct network perimeter triage.

Observed Threat Aliases: Lumma Stealer, LummaC2, LummaStealer, Trojan:Win32/Lumma, Win32/LummaStealer, Lumma.C2

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: Proprietary origin

Documented Downstream Variants: lummac2_v1, lummac2_v2, lummac2_v3_decoy_c2, lumma_corporate_build

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by LummaC2 Stealer operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• ClearFake drive-by compromise injecting fake browser update overlays on compromised WordPress sites
• Malicious internet shortcuts (.url) exploiting Windows SmartScreen defense evasion vulnerability CVE-2024-21412
• Spear-phishing archives with weaponized files exploiting WinRAR vulnerability CVE-2023-38831

Host Persistence & Execution Hooks

• Runs as an ephemeral in-memory payload exiting immediately after exfiltration to evade detection
• Scheduled task execution via schtasks for enterprise-level persistence
• Registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Reference File Hashes (SHA-256)

• 31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad
• b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025
• 9bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a420