❌

Normal view

Received before yesterday

Threat Research – Sophos News
Lumma Stealer, coming and going 9 May 2025 at 04:12

Lumma Stealer, coming and going

Threat Research – Sophos News

9 May 2025 at 04:12

The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive

A legitimate-seeming verification challenge

A second verification challenge, described in text

A flow chart depicting attack flow for Lumma Stealer

The poisoned download described in text

A listing of assorted files dropped by the malicious downloader

Log activity caused by the described EXE

An apparently legitimately "PDF," with a warning visible

A system message indicating that authorship of the alleged "PDF cannot be verified

A view of the shortcut showing a great deal of obfuscation

Hex code showing the first execution

Encryption in use

A CyberChef screen showing the code under examination

The questionable file, semi-decoded, now seen in Base64

The PE file fully dissected

Hex code showing the unique identifier

The highly obfuscated filepath

Another view of the filepath

Another obfuscated view, this time of the execution instruction

The code executes

A large block of obfuscation with many amusing words, mainly concerning snacks

Security Operations – Sophos News
Lumma Stealer, coming and going 9 May 2025 at 04:12

Lumma Stealer, coming and going

Security Operations – Sophos News

9 May 2025 at 04:12

The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive

A legitimate-seeming verification challenge

A second verification challenge, described in text

A flow chart depicting attack flow for Lumma Stealer

The poisoned download described in text

A listing of assorted files dropped by the malicious downloader

Log activity caused by the described EXE

An apparently legitimately "PDF," with a warning visible

A system message indicating that authorship of the alleged "PDF cannot be verified

A view of the shortcut showing a great deal of obfuscation

Hex code showing the first execution

Encryption in use

A CyberChef screen showing the code under examination

The questionable file, semi-decoded, now seen in Base64

The PE file fully dissected

Hex code showing the unique identifier

The highly obfuscated filepath

Another view of the filepath

Another obfuscated view, this time of the execution instruction

The code executes

A large block of obfuscation with many amusing words, mainly concerning snacks