Unveiling LummaStealer’s Technical Details Through ML-Based Detection Approach

In early 2025, LummaStealer was in widespread use by cybercriminals across multiple industries, and a May law enforcement operation brought it to a halt before new variants re-emerged. According to Netskope Threat Labs, a fresh LummaStealer sample (hash: 87118baadfa7075d7b9d2aff75d8e730) was analysed using a ML-driven detection strategy that fuses static signatures with dynamic sandboxing and behavioural analysis.

The ML approach detonates suspicious files in a Windows cloud sandbox to record runtime events such as process trees, API calls, DLL interactions, registry modifications, file operations and network activity, with a transformer-based model ingesting the hierarchical process tree and vectorising runtime behaviour. The sample was an NSIS installer; extraction revealed Parish.m4a, an obfuscated batch file and an autoit3.exe payload, with anti-analysis features and DLL unhooking to bypass security hooks.

The investigation notes initial low VirusTotal detection (9/73) and that Netskope’s detection flagged the sample as malicious, with detection codes including Win32.Exploit[.]Generic and Gen.Detect.By.NSCloudSandbox[.]tr, underscoring the value of ML-powered, multi-layered protection.