Lumma Stealer: Tactics, Impact, and Defense Strategies – CYFIRMA

MITRE Techniques

• [T1592] Gather Victim Host Information – DNS query to resolve the IP address of hardcoded domains and begin communicating with the first domain that resolves successfully. “The start DNS query/response … and begins communicating with the first domain that resolves successfully.”
• [T1204.002] Malicious File – The subject sample is distributed as a free antivirus on a counterfeit site posing as Bitdefender. “The subject sample of this analysis is being distributed as a free version of antivirus on a counterfeit website posing as a Bitdefender product.”
• [T1055] Process Injection – The malware creates a suspended BitLockerToGo.exe process, allocates memory, and performs injection by writing the malicious code. “creates a suspended process of BitLockerToGo.exe … allocates memory … and injects by writing the allocated memory with the malicious code.”
• [T1622] Debugger Evasion – The malware uses debugger checks to evade analysis. “IsDebuggerPresent and OutputDebugString to detect the presence of a debugger.”
• [T1497] Virtualization/Sandbox Evasion – Anti-analysis measures to avoid security research. “Detects debugger and analysis environment.”
• [T1140] Deobfuscate/Decode Files or Information – Obfuscation techniques to hide data during transfer; deobfuscation may be implied in data handling. “custom obfuscation techniques … to conceal the stolen data over the network.”
• [T1083] File and Directory Discovery – Scans for files containing keywords (seed.txt, pass.txt, etc.). “scans the compromised system for files containing keywords such as seed.txt, pass.txt, ledger.txt…”
• [T1071.001] Web Protocols – C2 communications over TLS with hardcoded domains. “The communications are encrypted using TLS v1.2” and multiple domains used for C2.
• [T1041] Exfiltration Over C2 Channel – Data exfiltration to C2 over an encrypted channel. “exfiltrates data to the C2 server over an encrypted channel.”