TW / Independent
← Research audits

Malware Analysis / Evidence: no local binary artefact

Lumma Stealer: browser data, fallback C2 and session risk

Analysis of the MaaS architecture documented in 2025: obfuscation, browser and wallet access, tiered C2 resolution and follow-on account risk.

Scope
Public Microsoft analysis of malware capabilities, delivery paths and infrastructure before a coordinated disruption.
Method
Static source and architecture review; no malware obtained, built or executed.
Evidence
No local sample; the Microsoft report used here does not publish a clearly attributable sample hash.
Finding

Target artifacts and the infrastructure model are documented in detail; variant coverage and current operation remain open.

No independent sample, runtime, C2 or campaign verification.

Analyst note

What the evidence actually supports.

Lumma is not one stable sample but a moving MaaS ecosystem. This analysis therefore concentrates on the recurring access path to browser and wallet data and treats version claims as context.

Evidence anchoropen evidence gap
Artefact
Kein Binärartefakt im Prüfbestand
SHA-256
not available
Analysis basis
No local sample; the Microsoft report used here does not publish a clearly attributable sample hash.
Malware / Evidence Atlas

Execution → Transfer

The analysis path for this report. Every node shows what is supported, where detection can start and where the claim stops.

5flow nodes 2detection artefacts 2rule formats
Claim

Execution

The source-bound case chain begins with execution of the stealer payload.

Detection focus

Record origin, signing state and process parents.

Bound to primary research
Config Surface

Configuration fingerprint

Review pivots derived from the report — not a live configuration or universal family indicator.

01
Browser storeslogin / cookie DB
core
02
Wallet pathsextension data
support
03
Fallbackservice profile
support
04
Upload boundarycorrelation needed
boundary
MODEL / 2DA78A72Core, support and boundary — not risk scores
Detection Pack

Defensive artefacts

Source, validation and limits accompany every rule.

SourceOriginal derivation from the reported behaviour chain.ValidationParsed by pySigma; synthetic truth table 3/3.LimitBrowser-profile access is a hunt and can match legitimate migration tools.
SigmaOpen rule
Defensive model
title: Lumma browser-store access candidate
status: experimental
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '\\User Data\\Default\\Login Data'
      - '\\Mozilla\\Firefox\\Profiles'
  filter_legitimate:
    Image|startswith: 'C:\\Program Files\\'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate administrative or software activity with the same isolated pattern
level: medium

Evidence status Supported by review evidenceBound to primary researchBounded or unresolved

Scope, snapshot and evidence boundary

Public Microsoft analysis of malware capabilities, delivery paths and infrastructure before a coordinated disruption. The bounded question is: which architecture and behaviour claims does this specific evidence set support, and which remain attributable only to the source?

What is supported — and what is missing

Primary sources, statically inspectable code and runtime observations carry different evidentiary weight. The map keeps those layers separate; missing first-party observation is not replaced by plausibility.

FILE / EVIDENCE MAP

Evidence chain and open runtime gap

The map separates primary source, reproducible source snapshots and runtime evidence not collected here.

A file reference does not establish runtime behaviour. Recorded processing is not a new execution.

SourceToolDerivedEvidenceMissingVerified referenceRecordedUnresolved

Evidence

Traceable source with an explicit sample gap.

Primary source

Published analysis or pinned upstream snapshot.

  • Primary source → Documented observationsdocumented by source · Recorded

    Not independently replayed against a sample here.

Related report section →
Documented observations

Sample, sandbox or telemetry claims made by the source.

  • Primary source → Documented observationsdocumented by source · Recorded

    Not independently replayed against a sample here.

  • Documented observations → No local malware sampleruntime unresolved · Unresolved

    The review remains static or source-bound.

Related report section →
No local malware sample

No first-party runtime, C2 or campaign telemetry.

  • Documented observations → No local malware sampleruntime unresolved · Unresolved

    The review remains static or source-bound.

Related report section →

Limit: A published observation is not an independent reproduction.

Entry and delivery chain

Microsoft describes multiple delivery paths rather than one fixed initial-access method: malvertising, fake CAPTCHA and software pages, manipulated repositories and legitimate cloud services. This variety belongs to the MaaS ecosystem and must not be modeled as one invariant Lumma chain.

Architecture and data flow

The core combines C++ and assembly, protecting critical functions with LLVM-based transformations, control-flow flattening, stack decryption and direct syscalls. Hard-coded tier-one C2 destinations are supplemented by pointers in Steam profiles and Telegram channels; these layers add resilience but are time-bound.

Analysis resistance and persistence

Large stack variables, dead code and control-flow obfuscation target static analysis. Direct syscalls and Heaven’s Gate further alter telemetry visibility. Binary complexity is still not family proof; it must be correlated with target artifacts and communication.

Capabilities, objective and impact

Lumma targets Chromium-, Mozilla- and Gecko-based browsers, cookies, passwords, autofill data, wallet files and extensions, plus VPN, mail, FTP and Telegram artifacts. Stolen session cookies can bypass controls, but successful reuse cannot be inferred from a host finding.

Telemetry plan and evidence chain

Priority belongs to the relationship between a newly started unknown process, access to multiple browser profiles and wallet paths, and a subsequent upload. Fallback services or individual filenames age quickly and create unnecessary false positives. A defensible investigation preserves process GUID and full ancestry, user and session, command line, signer and hash state, file and registry changes, DNS/connection destinations and follow-on access to sensitive data in one timeline. Temporal proximity is an evidence parameter, not mere visualization. Missing sensor coverage is marked per stage so that an unseen event is not falsely treated as an event that did not occur.

Detection engineering and countertesting

Priority belongs to the relationship between a newly started unknown process, access to multiple browser profiles and wallet paths, and a subsequent upload. Fallback services or individual filenames age quickly and create unnecessary false positives. The following model is deliberately narrow, not engine-validated and must be tested against legitimate administration and software paths.

yamlDefensive model, not engine-validatedDefensive model
title: Lumma browser-store access candidate
status: experimental
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '\\User Data\\Default\\Login Data'
      - '\\Mozilla\\Firefox\\Profiles'
  filter_legitimate:
    Image|startswith: 'C:\\Program Files\\'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate administrative or software activity with the same isolated pattern
level: medium
Read the code

Alternative hypotheses and negative tests

Before assigning the family, each signal used by the model is tested independently against software deployment, administration tools, installers, browser or backup software and known internal scripts. At least one structural anchor and one temporally consistent behaviour chain must align. MaaS customers use different delivery chains and configurations. The report does not establish current C2 reachability, a specific operator or completeness across all targeted applications. A negative countercheck rejects only the tested hypothesis; it is not a general all-clear.

Attribution and variant risk

MaaS customers use different delivery chains and configurations. The report does not establish current C2 reachability, a specific operator or completeness across all targeted applications.

Final assessment

The review provides a defensible architecture and detection baseline for the named snapshot. It is not proof of current activity, complete variant coverage or a specific operator.

Findings at a glance

  • Lumma separates flexible distribution, a heavily protected core and resilient C2 resolution.
  • Browser and session-token access is defensively more important than one IOC.
  • MaaS usage prevents simple equivalence between malware family and campaign actor.

Review limits

  • No independent sample, runtime, C2 or campaign verification.
  • MaaS customers use different delivery chains and configurations. The report does not establish current C2 reachability, a specific operator or completeness across all targeted applications.
  • Defensive models were not validated with a target engine.

Context, not evidence

The Evidence Anchor at the start identifies the binary, file or revision actually used. These links provide context and reported observations; they do not substitute for local sample analysis.

Microsoft Threat Intelligence — Lumma Stealer ↗
Final assessment

Conclusion

Conclusion: structure before signature

The greatest defensive value comes from connecting entry, internal architecture, persistence, impact and telemetry. Individual names, hashes or IOCs remain supporting evidence, not the conclusion.

Next steps

  • Test models against synthetic positives and legitimate negatives.
  • Rebind version and evidence snapshot with every update.
  • Extend runtime claims only after first-party, lawfully available telemetry.
Basis of this judgmentHigh for directly inspectable structure; limited for runtime and campaign claims not independently reproduced.
Public Microsoft analysis of malware capabilities, delivery paths and infrastructure before a coordinated disruption.
← All research audits

Start a conversation

Discuss your project.

Start a conversation