Cybereason LumaStealer Undated

Lumma Stealer has used PowerShell for initial user execution and other fuctions.

Lumma Stealer has used malicious Python scripts to execute payloads.

Lumma Stealer has utilized AutoIt malware scripts and AutoIt executables.

Lumma Stealer has gathered various system information from victim machines.

Lumma Stealer has taken screenshots of victim machines.

Lumma Stealer has automated collection of various information including cryptocurrency wallet details.

Lumma Stealer has installed a malicious browser extension to target Google Chrome, Microsoft Edge, Opera and Brave browsers for the purpose of stealing data.

Lumma Stealer has been delivered through cracked software downloads.

Lumma Stealer has been distributed through a fake CAPTCHA that presents instructions to the victim to open Windows Run window (“Windows Button + R”) and paste clipboard contents (“CTRL + V”) and press “Enter” to execute a Base64-encoded PowerShell.

Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files.

Lumma Stealer has identified and gathered information from two-factor authentication extensions for multiple browsers.

Lumma Stealer has harvested cookies from various browsers.

Lumma Stealer has created registry keys to maintain persistence using `HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.

Lumma Stealer has gathered credential and other information from multiple browsers.

Lumma Stealer has been delivered through phishing emails with malicious attachments.

Lumma Stealer has been delivered through phishing emails containing malicious links.

Lumma Stealer has leveraged legitimate applications to then side-load malicious DLLs during execution.