> Family · Lummastealer_

~/packetpursuit $ cat /intel/families/lummastealer.md

typeentityconfidencemediumcreated2026-05-29updated2026-07-16infostealermalware-familygolangsigningobfuscation

Lummastealer

Go-based info stealer family, labelled as lummastealer by OpenCTI. First encountered in the PacketPursuit corpus on 2026-05-26. May be an alias or fork of the acrstealer / orderreshop cluster, sharing identical build artefacts but marked with a distinct OpenCTI label.

Build Stack

  • Compiler: Go 1.25.4+ (GOARCH=386 and amd64 siblings observed, GOOS=windows, CGO_ENABLED=0, -trimpath=true) ^[/intel/analyses/d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f.html] ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html] ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Signing: Authenticode-signed PE. Two certificate chains observed:
    • Fraudulent self-signed: CN=www.sjabr.org, issuer CN=E8, validity 3 months (siblings d5647efd, e03dd36f) ^[/intel/analyses/d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f.html] ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html]
    • Let's Encrypt R12: CN=blizzard-tecnica.com, issuer CN=R12, validity 90 days (sibling 040e0d76) ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Obfuscation: Randomized Go module paths; randomized main.* function names (12–16-character mixed-case alphanumeric); no external packer ^[/intel/analyses/d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f.html] ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html] ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Resources: Builder has an icon-toggle option. Siblings d5647efd and e03dd36f have no .rsrc section; sibling 040e0d76 includes four embedded RT_ICON resources (~114 KB total) plus RT_VERSION. ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]

See golang-stealer-build-pattern for the full build-pattern concept.

Deploy / TTPs

  • Execution: Standard Go runtime.main entry; Windows GUI subsystem, no console window.
  • Network: Statically linked net/http and crypto/tls imply HTTPS C2, but no hardcoded C2 URL was found in strings. C2 endpoints are decoded at runtime via a PRNG-seeded transform. ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html] ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Collection: Inferred from family label and shared build pattern with acrstealer / orderreshop: browser credential stores, cryptocurrency wallets, FTP/SSH sessions, and system information.
  • Process manipulation: syscall.LoadLibrary calls inside large main.* functions suggest module-loading or injection behaviour ^[r2:0x4889d0 decompilation] ^[r2:sym.main.pkuetur @ 0x489d80].
  • Anti-analysis: See fused-string-api-decoding — API names are fused with DLL names into indivisible .rdata blobs and sliced at runtime, defeating naive string extraction. ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html] ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Memory staging: VirtualAlloc with PAGE_EXECUTE_READWRITE (0x3000, 0x40) observed in sym.main.cmvaso, consistent with reflective payload staging. ^[r2:sym.main.cmvaso @ 0x48afe0]

Capabilities

  • signed-pe-masquerade
  • go-symbol-name-obfuscation
  • go-static-binary-no-cgo
  • trimpath-source-stripping
  • runtime-decoded-c2-urls
  • prng-seeded-c2-url-decoding
  • tls-https-c2-client
  • browser-credential-dumping
  • cryptocurrency-wallet-targeting
  • module-loading-injection-routine
  • fused-string-api-decoding
  • icon-toggle-builder-option
  • letsencrypt-short-lived-cert
  • rwx-memory-alloc-staging
  • custom-stream-cipher-string-decoder

Variants / Aliases

  • OpenCTI labels: lummastealer, exe, signed, sunwukong (label collision — see sunwukong)
  • Possible relation to acrstealer / orderreshop cluster (same build pipeline; needs more siblings to confirm)

Notable Analyses

  • /intel/analyses/d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f.html — Go 1.25.4 PE32, module NZlhQRhWFITWnSR, cert CN=www.sjabr.org / issuer E8, no .rsrc, custom type names Altlrrq, Jhyfosq, etc.
  • /intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html — Go PE32+ x64 sibling, same cert CN, no .rsrc, fused-string API decoder, PRNG C2 resolution
  • /intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html — Go 1.25.4 PE32, module brIewNqtgMlfsdi, cert CN=blizzard-tecnica.com / issuer R12, has .rsrc icons, identical custom type names to d5647efd

Related