LummaStealer Malware Analizi

Dosya Ozellikleri

SHA256: d9c2c2d1513831f3ea9fb436917606169d14f21359dd09a5fa277c82171ea6cb

MD5: 2b5eb8be241364c1b501eb6397f32741

Dosya Tipi: exe

Boyut: 1,204,224 byte

Ilk Gorulme: 2026-05-19

AV Imzasi: LummaStealer

Imphash: f34d5f2d4577ed6d9ceec516c1f5a744

Raporlayan: BlinkzSec

Etiketler: LummaStealer

Statik analiz: metadata tabanli (ornek indirilmedi)

LummaStealer — マルウェアプロファイル

LummaStealer (LummaC2) is a C-based infostealer sold as MaaS. Steals credentials, crypto wallets, browser data. Highly active 2023-2025. Uses dead drop resolvers.

マルウェアの種類
Infostealer
プログラミング言語
C
C2プロトコル
HTTPS
標的システム
Windows
別名 (AKA)
LummaC2, Lumma C2, lummac

技術詳細

LummaStealer (LummaC2) is a C-based information stealer sold as Malware-as-a-Service since 2022. Targets 40+ browser extensions, crypto wallets (MetaMask, Exodus, Electrum, Binance, Coinbase, Atomic), browser credentials/cookies, 2FA authenticator databases, FTP clients, and custom file patterns. Uses dead drop resolvers: Steam profiles, Telegram channels, GitLab repositories to retrieve current C2 address. Anti-sandbox: CSPRNG-based timing checks, VM artifact detection, sleep timers. Delivered via fake software cracks, YouTube video descriptions, SEO-poisoned download pages. C2 communication: HTTPS POST to /c2sock or /api endpoint. Highly active 2023-2025, frequent updates to bypass AV detection.

アトリビューション / 脅威アクター

Unknown (Eastern European actor suspected)

機能と挙動

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOCリスト (1 件の指標)

IOC — LummaStealer
# FILEPATH d9c2c2d1513831f3ea9fb436917606169d14f21359dd09a5fa277c82171ea6cb
タイプ値メモ
filepath d9c2c2d1513831f3ea9fb436917606169d14f21359dd09a5fa277c82171ea6cb PDB
LummaStealer — 完全プロファイルへ →

C2サーバー (このファミリーで4台のサーバーを記録)

アドレス タイプ ポート プロトコル ステータス 国
45.133.174.124 ip 443 HTTPS inactive US
194.165.16.77 ip 443 HTTPS inactive RU
94.156.66.79 ip 443 HTTPS inactive RU
185.196.8.210 ip 443 HTTPS inactive RU

C2アドレスはKEYDALチームが手動で検証したマルウェア検体のみに基づいて提供されています。商用利用は禁止です。

タグ
LummaStealer