Analysis Summary

Lumma is an information stealer that is sold as a Malware-as-a-Service (MaaS) on Russian-speaking underground forums and Telegram. Lumma is an information stealer, which means its primary purpose is to steal sensitive data from infected systems. Lumma is written in the C programming language, which allows for efficient and low-level access to system resources. It is distributed as a service by LummaC, the seller, on Russian-speaking underground forums and Telegram channels. Lumma places a particular emphasis on stealing cryptocurrency wallets. This indicates that the malware is designed to target and extract sensitive information related to cryptocurrency, such as private keys or wallet.dat files. In addition to its focus on cryptocurrency wallets, Lumma also possesses file-grabber capabilities.

To protect against Lumma Stealer and similar threats, it is essential to follow security best practices. This includes regularly updating software and operating systems, using strong and unique passwords, implementing multi-factor authentication, exercising caution when opening email attachments or clicking on suspicious links, and using reputable antivirus/anti-malware solutions. Security awareness training can also help users recognize and avoid phishing attempts.

Impact

• Data Exfiltration
• Credential Theft
• Information Theft
• Financial Loss

Indicators of Compromise

MD5

• a6545d457801876214d08bf8dd163adb
• f72d1b75f6ab8637850c130111ab174a
• 0e3c053cccd97dc93b91dc9ceb00be01
• 427a063388d79b8cfec7e922feb81c07
• c641b3ee57b10edb933e1f5eddabce24
• 351c70ccd296daf50c31dce6ff0a7fd3
• 29f93e271c75b1c483a0da923cd86978
• 4cd9e71dbd4fe83c9e2646791c93089a
• 8ba18e12b5bad1967e04c93fe0df7899
• 206d3ede48db6abcd0887aab3442a590

SHA-256

• adeb891303c29978f5d896a58913fb0eeffe8a95f03629ff0f232e89d9990659
• 8f667976a8ae99b929b33236bce03a48a9526f94f87fbcde28746decbc9800c5
• 49317d725402f77e1253f32873158186473a7daf785786b3b310fc9dc8ba6121
• 0836b74c5507b060778ad90bab2ebd7bc230ffe3004d67ced991fa47ecbd566e
• 845b66567bfde5a0d1959f6d6ade4cbaa063b0f13c0fde2626950a67bfb05a6f
• 19d0604678ae18fddd83b968fb48eaa4bd256482aefd3d131b515f4f1d9f035b
• d6d869e1a10c6faaf3fce00bdecfed43268d50fa499d50493017717681a79922
• 92266e2506dbada2a9f94aa22c9b7b03b37771e97c58105f624748978827853e
• 3ac1ad7066fdd2b1537333b80aff6a005a72d133d4eaec0815b96d41ce947c69
• 835a32a57441be4b9f8861e80dd7a70c724c5024743d84fea0db6de46635e449

SHA-1

• 17e44e05ebdc458924983785f64257c258447da9
• d17726f2b118ea6732e7188d8619a829f350fa80
• c10ac13c4971781eeea01991b0fec0d474c95a98
• 9638f797e91ea60bd424b3b2ddef9d0d53a2e030
• 028a2826c6726e0facaf6902a4499a7697ff3e6c
• fa3c825f9c203dece8998c3e25c570d91ce4cbab
• 44ceb2f0677b71862ed6509ee5a2e5b76d73c126
• 2107a9bc99dfc0d1fac036c9e59a786626dae7d1
• 514387940b022c4df8002d267a8f03fcd5b2c72a
• 8fcb9af4c1c4bb3af65aa5da2e12d9256b038e9e

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Emails from unknown senders should always be treated with caution. Never trust or open links and attachments received from unknown sources/senders.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.