Lumma Stealer
Excerpt
Author: Federico Fantini
Estimated reading time: 30 minutes
Reading tip: Clicking on the image allows viewing it in full resolution for improved readability. Summary
Introduction
Lumma Stealer overview
Global Threat
Record growth
Campaigns
Persistence
Defense evasion
Telegram as marketplace for stolen logs
First stage analysis
Static analysis
Dynamic analysis and process "un-hollowing"
Injected memory analysis
Communication analysis (lumma v4)
InetSim
Proxy
Summary communication flow
act=life
act=recive_message
act=send_message (there are multiple requests)
act=get_message
Analysis of communication phases
Prerequisites for Advanced Analysis
Second stage analysis
Identifying the decryption routine
Understanding th…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by certego.github.io on certego.github.io.
Mentioned in the excerpt
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
