{
	"id": "0c6671c1-c2bb-4909-9ad3-7488eeb8f412",
	"created_at": "2026-04-10T03:20:21.856298Z",
	"updated_at": "2026-04-10T03:22:16.788707Z",
	"deleted_at": null,
	"sha1_hash": "f2fc5ce12faba85abdbcd164b2f1c29160f22475",
	"title": "The Case of LummaC2 v4.0",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 6731334,
	"plain_text": "The Case of LummaC2 v4.0\r\nBy eSentire Threat Response Unit (TRU)\r\nArchived: 2026-04-10 02:23:05 UTC\r\nAdversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters\r\nand Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.\r\nWe have discovered some of the most dangerous threats and nation state attacks in our space – including the\r\nKaseya MSP breach and the more_eggs malware.\r\nOur Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced\r\nThreat Analytics driven by our Threat Response Unit – the TRU team.\r\nIn TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We\r\noutline how we responded to the confirmed threat and what recommendations we have going forward.\r\nHere’s the latest from our TRU Team…\r\nWhat did we find?\r\nSince the beginning of August 2023, the eSentire Threat Response Unit (TRU) has observed 5 cases of Lumma\r\nStealer infections across manufacturing, retail, and business industries.\r\nThe infostealer was delivered via drive-by downloads disguised as fake installers such as Chrome and Edge\r\nbrowser installers. and some of them were distributed via PrivateLoader (a loader known to drop malware such as\r\nRedline, DCRat, and RaccoonStealer in the past).\r\neSentire TRU recently published a TRU Positive on LummaC2 delivering Amadey and PrivateLoader; you can\r\naccess the article here.\r\nLumma Stealer, also known as LummaC2, first appeared on Russian-speaking forums at the end of 2022. The\r\nstealer is written in C++, and the build size is approximately 150-396 KB. The pricing for the stealer is divided\r\ninto three categories:\r\nExperienced - $250/month: Includes capabilities such as downloading logs in bulk and the ability to filter\r\nthe logs by specific parameters.\r\nProfessional - $500/month: Includes capabilities such as creating an unlimited number of rules for the\r\nstealer, sharing the statistics with other people, non-residential loader, etc.\r\nCorporate - $1000/month: The developer claims that with the corporate plan, the user gets a random build\r\nby the morpher, which means each generated build is different from the other, implemented Heaven’s Gate\r\n(a technique used by malware to transition from 32-bit code execution to 64-bit code execution on x64\r\nWindows systems, it’s used to bypass dynamic analysis by sandboxes and debuggers).\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 1 of 23\n\nFigure 1: Stealer advertisement on Russian speaking forums\r\nThe stealer features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and\r\nPowerShell:\r\nFigure 2: Non-resident loader\r\nSome other notable features of the stealer include:\r\nControl Flow Flattening – code obfuscation technique used to make the program's control flow more\r\ncomplex and harder to analyze.\r\n“Spreading without the crypt protection” – if the generated stealer build is not crypted, the pop-up\r\nmessage will show up for the user upon running the build, as shown in Figure 3.\r\nFlexible file grabber – the ability to directly change the rules in the profile to grab specific data.\r\nFigure 3: Pop-up message if the build is not crypted\r\nTechnical Analysis\r\nFrom the previous versions of the stealer (the sample we observed in June, MD5:\r\na4e04604c178fe4fd19996b4d48b8885), as an obfuscation method, the stealer appends strings such as “576xe” to\r\nthe data.\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 2 of 23\n\nFigure 4: String obfuscation for previous versions of LummaC2\r\nBut with the latest versions (version 4.0), the stealer obfuscates the strings with an XOR algorithm. It converts the\r\nhexadecimal characters in the string into the decimal value. The first four bytes of the byte array of the string are\r\nused as the XOR key. Each subsequent byte in the array is XORed with the mentioned four bytes in a cyclic\r\nmanner. The decryption is shown algorithm is shown in the screenshot below.\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 3 of 23\n\nFigure 5: LummaC2 decryption algorithm\r\nFigure 6: String decrypter implementation in Python\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 4 of 23\n\nThe stealer uses MurmurHash2 hashing algorithm to resolve the APIs, in our example the seed is 0x20. The API\r\nhashing function is obfuscated with control flow flattening as the rest of the code (Figure 8).\r\nFigure 7: Snippet of code with control flow flattening\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 5 of 23\n\nFigure 8: API hashing function\r\nWe wrote the script to produce the hash values based on the seed for each API call within the DLL library found in\r\nthe stealer.\r\nC2 Communication\r\nUpon the initial infection, the stealer retrieves the configuration from the C2 (/c2conf). @Jane_0sint provided\r\ninsights on decrypting the configuration using the first 32-byte of the base64-encoded string as the key. That\r\nmeans that the crypto wallet extensions, applications, and list of browsers are not embedded in the stealer build\r\nanymore compared to previous versions of the stealer.\r\nHere is the example of the decrypted configuration retrieved from C2 (JSON format):\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 6 of 23\n\n{\r\n \"v\": 1,\r\n \"c\": [\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*.txt\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 1\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*key*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 1\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*bitcoin*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*binance*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*exodus*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*coinbase*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 7 of 23\n\n\"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*wallet*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*seed*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*pass*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*ledger*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*trezor*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*metamask*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 3\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*crypto*\",\r\n \"z\": \"Important Files/Profile\",\r\n \"d\": 1\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 8 of 23\n\n},\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Binance\",\r\n \"m\": \"app-store.json\",\r\n \"z\": \"Wallets/Binance\",\r\n \"d\": 1\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Binance\",\r\n \"m\": \".finger-print.fp\",\r\n \"z\": \"Wallets/Binance\",\r\n \"d\": 1\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Binance\",\r\n \"m\": \"simple-storage.json\",\r\n \"z\": \"Wallets/Binance\",\r\n \"d\": 1\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Electrum\\\\wallets\",\r\n \"m\": \"*\",\r\n \"z\": \"Wallets/Electrum\",\r\n \"d\": 1\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Ethereum\",\r\n \"m\": \"keystore\",\r\n \"z\": \"Wallets/Ethereum\",\r\n \"d\": 1\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Exodus\\\\exodus.wallet\",\r\n \"m\": \"*\",\r\n \"z\": \"Wallets/Exodus\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Ledger Live\",\r\n \"m\": \"*\",\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 9 of 23\n\n\"z\": \"Wallets/Ledger Live\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\atomic\\\\Local Storage\\\\leveldb\",\r\n \"m\": \"*\",\r\n \"z\": \"Wallets/Atomic\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%localappdata%\\\\Coinomi\\\\Coinomi\\\\wallets\",\r\n \"m\": \"*\",\r\n \"z\": \"Wallets/Coinomi\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Authy Desktop\\\\Local Storage\\\\leveldb\",\r\n \"m\": \"*\",\r\n \"z\": \"Wallets/Authy Desktop\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Bitcoin\\\\wallets\",\r\n \"m\": \"*\",\r\n \"z\": \"Wallets/Bitcoin core\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\com.liberty.jaxx\\\\IndexedDB\",\r\n \"m\": \"*.leveldb\",\r\n \"z\": \"Wallets/JAXX New Version\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Electrum\\\\wallets\",\r\n \"m\": \"*\",\r\n \"z\": \"Wallets/Electrum\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 10 of 23\n\n\"p\": \"%appdata%\\\\AnyDesk\",\r\n \"m\": \"*.conf\",\r\n \"z\": \"Applications/AnyDesk\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\FileZilla\",\r\n \"m\": \"recentservers.xml\",\r\n \"z\": \"Applications/FileZilla\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\FileZilla\",\r\n \"m\": \"sitemanager.xml\",\r\n \"z\": \"Applications/FileZilla\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%userprofile%\",\r\n \"m\": \"*.kbdx\",\r\n \"z\": \"Applications/KeePass\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%programfiles%\\\\Steam\",\r\n \"m\": \"ssfn*\",\r\n \"z\": \"Applications/Steam\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%programfiles%\\\\Steam\\\\config\",\r\n \"m\": \"*\",\r\n \"z\": \"Applications/Steam/config\",\r\n \"d\": 2\r\n },\r\n {\r\n \"t\": 0,\r\n \"p\": \"%appdata%\\\\Telegram Desktop\",\r\n \"m\": \"*s\",\r\n \"z\": \"Applications/Telegram\",\r\n \"d\": 2\r\n },\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 11 of 23\n\n{\r\n \"t\": 1,\r\n \"e\": [\r\n {\r\n \"en\": \"ejbalbakoplchlghecdalmeeeajnimhm\",\r\n \"ez\": \"MetaMask\"\r\n },\r\n {\r\n \"en\": \"nkbihfbeogaeaoehlefnkodbefgpgknn\",\r\n \"ez\": \"MetaMask\"\r\n },\r\n {\r\n \"en\": \"egjidjbpglichdcondbcbdnbeeppgdph\",\r\n \"ez\": \"Trust Wallet\"\r\n },\r\n {\r\n \"en\": \"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\r\n \"ez\": \"TronLink\"\r\n },\r\n {\r\n \"en\": \"fnjhmkhhmkbjkkabndcnnogagogbneec\",\r\n \"ez\": \"Ronin Wallet\"\r\n },\r\n {\r\n \"en\": \"fhbohimaelbohpjbbldcngcnapndodjp\",\r\n \"ez\": \"Binance Chain Wallet\"\r\n },\r\n {\r\n \"en\": \"ffnbelfdoeiohenkjibnmadjiehjhajb\",\r\n \"ez\": \"Yoroi\"\r\n },\r\n {\r\n \"en\": \"jbdaocneiiinmjbjlgalhcelgbejmnid\",\r\n \"ez\": \"Nifty\"\r\n },\r\n {\r\n \"en\": \"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\r\n \"ez\": \"Math\"\r\n },\r\n {\r\n \"en\": \"hnfanknocfeofbddgcijnmhnfnkdnaad\",\r\n \"ez\": \"Coinbase\"\r\n },\r\n {\r\n \"en\": \"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\r\n \"ez\": \"Guarda\"\r\n },\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 12 of 23\n\n{\r\n \"en\": \"blnieiiffboillknjnepogjhkgnoapac\",\r\n \"ez\": \"EQUA\"\r\n },\r\n {\r\n \"en\": \"cjelfplplebdjjenllpjcblmjkfcffne\",\r\n \"ez\": \"Jaxx Liberty\"\r\n },\r\n {\r\n \"en\": \"fihkakfobkmkjojpchpfgcmhfjnmnfpi\",\r\n \"ez\": \"BitApp\"\r\n },\r\n {\r\n \"en\": \"kncchdigobghenbbaddojjnnaogfppfj\",\r\n \"ez\": \"iWlt\"\r\n },\r\n {\r\n \"en\": \"kkpllkodjeloidieedojogacfhpaihoh\",\r\n \"ez\": \"EnKrypt\"\r\n },\r\n {\r\n \"en\": \"amkmjjmmflddogmhpjloimipbofnfjih\",\r\n \"ez\": \"Wombat\"\r\n },\r\n {\r\n \"en\": \"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\r\n \"ez\": \"MEW CX\"\r\n },\r\n {\r\n \"en\": \"nanjmdknhkinifnkgdcggcfnhdaammmj\",\r\n \"ez\": \"Guild\"\r\n },\r\n {\r\n \"en\": \"nkddgncdjgjfcddamfgcmfnlhccnimig\",\r\n \"ez\": \"Saturn\"\r\n },\r\n {\r\n \"en\": \"cphhlgmgameodnhkjdmkpanlelnlohao\",\r\n \"ez\": \"NeoLine\"\r\n },\r\n {\r\n \"en\": \"nhnkbkgjikgcigadomkphalanndcapjk\",\r\n \"ez\": \"Clover\"\r\n },\r\n {\r\n \"en\": \"kpfopkelmapcoipemfendmdcghnegimn\",\r\n \"ez\": \"Liquality\"\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 13 of 23\n\n},\r\n {\r\n \"en\": \"aiifbnbfobpmeekipheeijimdpnlpgpp\",\r\n \"ez\": \"Terra Station\"\r\n },\r\n {\r\n \"en\": \"dmkamcknogkgcdfhhbddcghachkejeap\",\r\n \"ez\": \"Keplr\"\r\n },\r\n {\r\n \"en\": \"fhmfendgdocmcbmfikdcogofphimnkno\",\r\n \"ez\": \"Sollet\"\r\n },\r\n {\r\n \"en\": \"cnmamaachppnkjgnildpdmkaakejnhae\",\r\n \"ez\": \"Auro\"\r\n },\r\n {\r\n \"en\": \"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\r\n \"ez\": \"Polymesh\"\r\n },\r\n {\r\n \"en\": \"flpiciilemghbmfalicajoolhkkenfe\",\r\n \"ez\": \"ICONex\"\r\n },\r\n {\r\n \"en\": \"nknhiehlklippafakaeklbeglecifhad\",\r\n \"ez\": \"Nabox\"\r\n },\r\n {\r\n \"en\": \"hcflpincpppdclinealmandijcmnkbgn\",\r\n \"ez\": \"KHC\"\r\n },\r\n {\r\n \"en\": \"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\r\n \"ez\": \"Temple\"\r\n },\r\n {\r\n \"en\": \"mnfifefkajgofkcjkemidiaecocnkjeh\",\r\n \"ez\": \"TezBox\"\r\n },\r\n {\r\n \"en\": \"lodccjjbdhfakaekdiahmedfbieldgik\",\r\n \"ez\": \"DAppPlay\"\r\n },\r\n {\r\n \"en\": \"ijmpgkjfkbfhoebgogflfebnmejmfbm\",\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 14 of 23\n\n\"ez\": \"BitClip\"\r\n },\r\n {\r\n \"en\": \"lkcjlnjfpbikmcmbachjpdbijejflpcm\",\r\n \"ez\": \"Steem Keychain\"\r\n },\r\n {\r\n \"en\": \"onofpnbbkehpmmoabgpcpmigafmmnjh\",\r\n \"ez\": \"Nash Extension\"\r\n },\r\n {\r\n \"en\": \"bcopgchhojmggmffilplmbdicgaihlkp\",\r\n \"ez\": \"Hycon Lite Client\"\r\n },\r\n {\r\n \"en\": \"klnaejjgbibmhlephnhpmaofohgkpgkd\",\r\n \"ez\": \"ZilPay\"\r\n },\r\n {\r\n \"en\": \"aeachknmefphepccionboohckonoeemg\",\r\n \"ez\": \"Coin98\"\r\n },\r\n {\r\n \"en\": \"bhghoamapcdpbohphigoooaddinpkbai\",\r\n \"ez\": \"Authenticator\"\r\n },\r\n {\r\n \"en\": \"dkdedlpgdmmkkfjabffeganieamfklkm\",\r\n \"ez\": \"Cyano\"\r\n },\r\n {\r\n \"en\": \"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\r\n \"ez\": \"Byone\"\r\n },\r\n {\r\n \"en\": \"infeboajgfhgbjpjbeppbkgnabfdkdaf\",\r\n \"ez\": \"OneKey\"\r\n },\r\n {\r\n \"en\": \"cihmoadaighcejopammfbmddcmdekcje\",\r\n \"ez\": \"Leaf\"\r\n },\r\n {\r\n \"en\": \"gaedmjdfmmahhbjefcbgaolhhanlaolb\",\r\n \"ez\": \"Authy\"\r\n },\r\n {\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 15 of 23\n\n\"en\": \"oeljdldpnmdbchonielidgobddfffla\",\r\n \"ez\": \"EOS Authenticator\"\r\n },\r\n {\r\n \"en\": \"ilgcnhelpchnceeipipijaljkblbcob\",\r\n \"ez\": \"GAuth Authenticator\"\r\n },\r\n {\r\n \"en\": \"imloifkgjagghnncjkhggdhalmcnfklk\",\r\n \"ez\": \"Trezor Password Manager\"\r\n },\r\n {\r\n \"en\": \"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\r\n \"ez\": \"Phantom\"\r\n },\r\n {\r\n \"en\": \"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\r\n \"ez\": \"UniSat\"\r\n }\r\n ],\r\n \"n\": [\r\n {\r\n \"p\": \"%localappdata%\\\\Google\\\\Chrome\\\\User Data\",\r\n \"z\": \"Chrome\"\r\n },\r\n {\r\n \"p\": \"%localappdata%\\\\Chromium\\\\User Data\",\r\n \"z\": \"Chromium\"\r\n },\r\n {\r\n \"p\": \"%localappdata%\\\\Microsoft\\\\Edge\\\\User Data\",\r\n \"z\": \"Edge\"\r\n },\r\n {\r\n \"p\": \"%localappdata%\\\\Kometa\\\\User Data\",\r\n \"z\": \"Kometa\"\r\n },\r\n {\r\n \"p\": \"%appdata%\\\\Opera Software\\\\Opera Stable\",\r\n \"z\": \"Opera Stable\"\r\n },\r\n {\r\n \"p\": \"%appdata%\\\\Opera Software\\\\Opera GX Stable\",\r\n \"z\": \"Opera GX Stable\"\r\n },\r\n {\r\n \"p\": \"%appdata%\\\\Opera Software\\\\Opera Neon\\\\User Data\",\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 16 of 23\n\n\"z\": \"Opera Neon\"\r\n },\r\n {\r\n \"p\": \"%localappdata%\\\\BraveSoftware\\\\Brave-Browser\\\\User Data\",\r\n \"z\": \"Brave Software\"\r\n },\r\n {\r\n \"p\": \"%localappdata%\\\\Comodo\\\\Dragon\\\\User Data\",\r\n \"z\": \"Comodo\"\r\n },\r\n {\r\n \"p\": \"%localappdata%\\\\CocCoc\\\\Browser\\\\User Data\",\r\n \"z\": \"CocCoc\"\r\n }\r\n ]\r\n },\r\n {\r\n \"t\": 2,\r\n \"p\": \"%appdata%\\\\Mozilla\\\\Firefox\\\\Profiles\",\r\n \"z\": \"Mozilla Firefox\"\r\n }\r\n ]\r\n}\r\nFigure 9: Output of the configuration extractor script\r\nExample of additional data obtained from C2: lid=KjGtqi--\r\nVIKKY\u0026j=e799236f7a828928688bbd10d343328e\u0026ver=4.0, where the lid is the LummaC2 ID, the value\r\n“VIKKY” is likely the build ID assigned and the stealer version (ver=). The logs are exfiltrated over the ZIP\r\narchive, as shown in the screenshot below (/c2sock).\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 17 of 23\n\nFigure 10: Exfiltrated logs\r\nFigure 11: Log formatting (System.txt)\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 18 of 23\n\nFigure 12: Function responsible for collecting system information and parsing it to the System.txt\r\nfile\r\nFigure 13: The contents of the ZIP archive (Source: Dark2Web)\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 19 of 23\n\nWhat did we do?\r\nOur team of 24/7 SOC Cyber Analysts isolated affected host to contain the infection.\r\nWe also provided remediation recommendations and support to the customer.\r\nWhat can you learn from this TRU positive?\r\nLummaC2, which is written in C++, is delivered via drive-by downloads.\r\nThe new version of the stealer (4.0) uses the XOR algorithm for string encryption.\r\nIt applies control flow flattening to complicate the analysis as well as API hashing using the MurmurHash2\r\nhashing algorithm.\r\nLummaC2 Stealer is sold in three different tiers: Experienced, Professional, and Corporate. The last one\r\ncomes with a Heaven’s Gate technique.\r\nRecommendations from our Threat Response Unit (TRU):\r\nProtecting against information stealers requires a multi-layered defense approach to defend endpoints from\r\nmalware and detect or block unauthorized login activity against applications and remote access services.\r\nTherefore, we recommend:\r\nProtecting endpoints against malware.\r\nEnsure antivirus signatures are up to date.\r\nUse a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) product to detect and\r\ncontain threats.\r\nIf an information stealing malware is identified, reset the user’s credentials and terminate logon\r\nsessions immediately.\r\nEncouraging good cybersecurity hygiene among your users by using Phishing and Security Awareness\r\nTraining (PSAT) when downloading software from the Internet.\r\nRestricting access to enterprise applications from personal devices outside the scope of security\r\nmonitoring.\r\nEnsuring adequate logging is in place for remote access services such as VPNs and using modern\r\nauthentication methods, which support MFA and conditional access.\r\nPrevent web browsers from automatically saving and storing passwords.\r\nIt is recommended to use password managers instead.\r\nIndicators of Compromise\r\nName Indicators\r\nC2 gservice-node[.]io\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 20 of 23\n\nC2 gstatic-node[.]io\r\nC2 balancelag[.]xyz\r\nC2 doorblu[.]xyz\r\nPayload c9094685ae4851fd5a5b886b73c7b07efd9b47ea0bdae3f823d035cf1b3b9e48\r\nPayload 3bf4b365d61c1e9807d20e71375627450b8fea1635cb6ddb85f2956e8f6b3ec3\r\nPayload a9c7c4df7e39b8bc7b03b7d4053066d26154bc76c3e261fff84f2339d44a474e\r\nPayload b803e8d9da6efe7b0220f654c7afb784d21dc222afd4a4e41396e74f861cbf30\r\nYara\r\nrule LummaC2 {\r\n meta:\r\n author = \"RussianPanda\"\r\n description = \"LummaC2 Detection\"\r\n strings:\r\n $p1=\"lid=%s\u0026j=%s\u0026ver\"\r\n $p2= {89 ca 83 e2 03 8a 54 14 08 32 54 0d 04}\r\n condition:\r\n all of them and filesize \u003c= 500KB\r\n}\r\nReference\r\nhttps://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/\r\nhttps://twitter.com/Jane_0sint/status/1672374464418394112?s=20\r\nTo learn how your organization can build cyber resilience and prevent business disruption with eSentire’s Next\r\nLevel MDR, connect with an eSentire Security Specialist now.\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 21 of 23\n\nGET STARTED\r\nABOUT ESENTIRE’S THREAT RESPONSE UNIT (TRU)\r\nThe eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your\r\norganization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7\r\nSecurity Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and\r\nworks as an extension of your security team to continuously improve our Managed Detection and Response\r\nservice. By providing complete visibility across your attack surface and performing global threat sweeps and\r\nproactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending\r\nyour organization against known and unknown threats.\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 22 of 23\n\nSource: https://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nhttps://www.esentire.com/blog/the-case-of-lummac2-v4-0\r\nPage 23 of 23\n\n https://www.esentire.com/blog/the-case-of-lummac2-v4-0 \nFigure 5: LummaC2 decryption algorithm \nFigure 6: String decrypter implementation in Python\n  Page 4 of 23",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.esentire.com/blog/the-case-of-lummac2-v4-0"
	],
	"report_names": [
		"the-case-of-lummac2-v4-0"
	],
	"threat_actors": [],
	"ts_created_at": 1775791221,
	"ts_updated_at": 1775791336,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/f2fc5ce12faba85abdbcd164b2f1c29160f22475.pdf",
		"text": "https://archive.orkl.eu/f2fc5ce12faba85abdbcd164b2f1c29160f22475.txt",
		"img": "https://archive.orkl.eu/f2fc5ce12faba85abdbcd164b2f1c29160f22475.jpg"
	}
}