The Lumma information stealer, a notorious C++ malware strain, continues its prominence in the cyber threat landscape, employing sophisticated infection chains and obfuscation methods.
WithSecure’s Detection and Response Team has observed a surge in infections via Lumma, often enabled by initial loaders written in .NET/C#.
These loaders saw heightened activity in early 2025, marking Lumma as a persistent Danger lurking in both underground forums and open-source malware repositories. The deployment phase typically begins with a 32-bit .NET binary, under obfuscated assembly names.
This initial stage loader validates its own executable structure using precise checks on DOS and PE headers, ensuring only legitimate instances proceed.
It then parses the binary’s section headers, programmatically seeking and copying the .CODE section, a process obfuscated by dynamically calculated hashes, hiding its trail from analysts and traditional detection systems.
Detailed Memory Decryption
Once the target section is identified, a decryption phase is triggered using embedded routines. The loader leverages Windows API functions particularly VirtualProtect, to set executable permissions, and CallWindowProcA, which enables execution of decrypted code dynamically in memory.
According to the report, this sophisticated unpacking eliminates static signatures, frustrating signature-based defense mechanisms.
The decrypted modules then initiate self-replication and network communication, reaching out to a variety of command-and-control (C2) domains.
This is achieved while evading detection through deep API resolution via direct parsing of the Process Environment Block (PEB) and manipulating internal data structures to recover the addresses of core Windows API functions such as LoadLibraryA and GetProcAddress.
These actions collectively facilitate remote process injection, further camouflaged under the pretext of legitimate system calls.
Infection Escalation
Escalation continues through precise process injection tactics. The malware spawns a suspended process using legitimate system binaries, allocates memory in the remote process space, and maps its payload inside the target with WriteProcessMemory calls, performing near-complete PE loading and in-memory execution.
The thread is then resumed, seamlessly running injected code. The Lumma deployment thus remains invisible to regular process monitoring and circumvents endpoint protections through direct system memory interaction.
Subsequent payload stages reinforce obfuscation. Advanced control flow flattening fragments Lumma’s functions into irregular blocks, executed via runtime-calculated jumps.
This crushed code structure renders disassembly arduous and undermines automated static analysis.
Lumma also implements environmental checks, prohibiting execution in regions that use the Russian locale, demonstrating attacker awareness of operational safety and regional targeting.
Additional persistence measures include intricate checks to ensure proper infection only under packed/obfuscated delivery and not via direct binary execution.
The payload is also equipped with routines for stealthy configuration retrieval from C2s, employing ChaCha20 to decrypt domains, and only proceeding with POST-based exfiltration if all pre-flight integrity checks pass.
Despite the recent law enforcement crackdown on Lumma’s infrastructure, Microsoft reported hundreds of thousands of infections worldwide in spring 2025.
The infrastructure takedown represents a temporary setback, with the threat actor ecosystem likely to adapt or rebrand swiftly.
Lumma’s development and distribution routines, including exclusive distribution via invitation-only Telegram channels and strict “fully undetectable” (FUD) packing requirements, illustrate a mature Malware-as-a-Service (MaaS) model.
The evolution of Lumma highlights broader industry shifts where commodity infostealers, modular loaders, and professionalized IAB (Initial Access Broker) services continually advance their tradecraft, with a focus on behavioral detections, in-memory execution, and evasion of prevailing security tools.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
