Lumma Stealer (LummaC2): Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "Microsoft Visual C/C++ (MSVC) optimized for size (/O1 or /Os)",
  "runtime": "Win32 C Runtime with direct NTAPI syscalls",
  "binary_footprint": "Single PE32 executable, typically 120 KB - 280 KB uncompressed",
  "stub_size": "184,320 bytes (typical unpacked sample)",
  "packer_obfuscation": "Intense control-flow flattening (CFF), opaque predicate insertion, Heaven's Gate execution transitions under WOW64, dynamic string decoding",
  "subsystem": "Windows GUI (Subsystem 2)",
  "entry_point_flow": "Entry -> Anti-Analysis & Mouse Position Differential Check -> Heaven's Gate WOW64 transition -> Dynamic Syscall Resolution -> Resolve C2 Domain Array -> Retrieve Target Config -> Execute Stealer Modules -> Dispatch Payload -> Terminate",
  "technical_summary": "Lumma Stealer (LummaC2) is a sophisticated Malware-as-a-Service information stealer written in C. It employs aggressive defense evasion, including mouse movement trajectory validation, Heaven's Gate execution transitions to bypass WOW64 hooks, and indirect syscalls. Its C2 infrastructure utilizes fast-flux domain networks across low-cost TLDs (.pw, .shop, .top) fronted by Cloudflare CDN edge nodes."
}

{
  "interface_type": "MaaS Web Panel / Operator Dashboard",
  "builder_tabs_options": [
    {
      "tab": "Affiliate Dashboard",
      "options": [
        "Real-time log ingestion stream showing victim IP, country, and stolen asset counters",
        "Automated wallet sorter filtering by token balance and blockchain address activity",
        "Cookie format validator converting raw sqlite exports into Netscape format"
      ]
    },
    {
      "tab": "Payload Configuration",
      "options": [
        "Affiliate Tag: Unique string assigned to operator (e.g., 'aff_7812')",
        "Domain Array: Entry of 9-10 rotating C2 endpoint domains",
        "File Grabber Config: Regular expressions defining file extensions, directory depths, and size caps (default < 10MB)",
        "Loader Integration: Configuration of secondary executable download URL and execution conditions"
      ]
    }
  ],
  "config_struct_layout": [
    {
      "offset": "0x0000",
      "field": "BuildId",
      "type": "char[32]",
      "description": "Affiliate identification string"
    },
    {
      "offset": "0x0020",
      "field": "C2DomainCount",
      "type": "uint32",
      "description": "Number of embedded active C2 domains"
    },
    {
      "offset": "0x0024",
      "field": "C2DomainPointers",
      "type": "uint32[10]",
      "description": "Offsets to XOR-obfuscated domain strings"
    },
    {
      "offset": "0x004C",
      "field": "XorSeed",
      "type": "uint32",
      "description": "Seed value for PRNG-based string decryption"
    },
    {
      "offset": "0x0050",
      "field": "GrabberRules",
      "type": "char[256]",
      "description": "Semicolon-delimited target file extension patterns"
    }
  ],
  "payload_generation_flags": [
    "Target Subsystem: Win32 GUI",
    "Control Flow Flattening: Enabled",
    "Indirect Syscalls: Native x64 WOW64 Gate"
  ],
  "operator_commands": [
    "TASK_DOWNLOAD_EXEC: Downloads binary from specified URL and invokes via CreateProcessW",
    "TASK_UPDATE_DOMAINS: Updates active internal C2 domain array in memory",
    "TASK_SLEEP: Adjusts beacon frequency interval",
    "TASK_KILL: Erases memory buffers and issues immediate process termination"
  ],
  "interface_telemetry_analysis": "The LummaC2 operator interface is accessible via private Tor hidden services or authenticated clearnet web portals. It features analytics detailing infection counts by country, top victim operating systems, total cryptocurrency wallets discovered, and automated filters for high-value banking and enterprise credentials."
}

struct Lumma_Stealer_(LummaC2)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Under WOW64 on 64-bit Windows, Lumma executes Heaven's Gate: issues a far jump (jmp 0x33:Offset) to transition the CPU from 32-bit compatibility mode into 64-bit long mode, executing 64-bit indirect syscalls directly and evading 32-bit userland API hooks installed by security products in ntdll.dll.",
  "ntapi_functions": [
    "ntdll!NtAllocateVirtualMemory",
    "ntdll!NtProtectVirtualMemory",
    "ntdll!NtWriteVirtualMemory",
    "ntdll!NtCreateThreadEx",
    "ntdll!NtResumeThread"
  ],
  "process_hollowing_target": "N/A (Executes primarily within initial process context or hollows into clean system utilities like svchost.exe / msiexec.exe)",
  "persistence_mechanics": [
    "Does not establish native persistence by default; functions as an ephemeral harvesting agent or downloads persistent secondary payloads via tasking"
  ],
  "evasion_hooks": [
    "Heaven's Gate 32-to-64 bit execution mode transition",
    "Dynamic runtime hashing of API strings using custom ROR13-based algorithms",
    "Hardware breakpoint detection inspecting DR0-DR7 debug registers via GetThreadContext"
  ],
  "anti_analysis": [
    "Human interaction heuristic: queries GetCursorPos across time intervals, computing Euclidean vector distance; halts execution if mouse cursor does not move continuously in a non-linear path",
    "Timing check via rdtsc and QueryPerformanceCounter detecting virtual machine instruction execution latency",
    "Blacklist validation of BIOS serials, disk model names (checking for 'VBOX', 'VMWARE', 'QEMU'), and sandbox DLL modules"
  ]
}

Concrete technical breakdown of functional modules implemented in the Lumma Stealer (LummaC2) binary:

{
  "framing": "HTTP/1.1 POST transactions with URI paths structured as randomized alphanumeric strings or /api endpoint paths",
  "serialization": "Base64-encoded compressed binary stream containing a 32-byte header followed by zlib-deflated JSON data",
  "handshake": "Client issues DNS queries against fast-flux domain array -> Establishes TCP connection to port 80/443 -> Dispatches initial check-in beacon containing hardware UUID and affiliate tag -> C2 returns encrypted tasking directives and target list",
  "cryptography": "Custom rolling XOR algorithm utilizing a 16-byte key derived from the build timestamp, combined with SSL/TLS transport layer encryption when routed through Cloudflare CDN proxies",
  "packet_types": [
    {
      "header": "POST /api",
      "payload": "Encrypted check-in beacon: HWID, OS, BuildTag",
      "direction": "Client -> C2"
    },
    {
      "header": "HTTP 200 OK",
      "payload": "Tasking response: active grabber rules, secondary download URLs",
      "direction": "C2 -> Client"
    },
    {
      "header": "POST /api/upload",
      "payload": "Multipart stream: Harvested archive data",
      "direction": "Client -> C2"
    }
  ],
  "traffic_signature": "Rapid outbound HTTP/HTTPS beaconing to high-entropy domains under .pw, .shop, .top, or .click TLDs, transmitting POST requests with User-Agent strings mimicking recent Chrome/Edge browser releases."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: