> Family · Lummastealer_

~/packetpursuit $ cat /intel/families/lummastealer.md

typeentitycreated2026-05-29updated2026-09-01infostealermalware-familygolangsigningobfuscation

Lummastealer

Go-based info stealer family, labelled as lummastealer by OpenCTI. First encountered in the PacketPursuit corpus on 2026-05-26. May be an alias or fork of the acrstealer / orderreshop cluster, sharing identical build artefacts but marked with a distinct OpenCTI label.

Build Stack

  • Compiler: Go 1.25.4+ (GOARCH=386 and amd64 siblings observed, GOOS=windows, CGO_ENABLED=0, -trimpath=true) ^[/intel/analyses/d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f.html] ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html] ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Signing: Authenticode-signed PE. Two certificate chains observed:
    • Fraudulent self-signed: CN=www.sjabr.org, issuer CN=E8, validity 3 months (siblings d5647efd, e03dd36f) ^[/intel/analyses/d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f.html] ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html]
    • Let's Encrypt R12: CN=blizzard-tecnica.com, issuer CN=R12, validity 90 days (sibling 040e0d76) ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Obfuscation: Randomized Go module paths; randomized main.* function names (12–16-character mixed-case alphanumeric); no external packer ^[/intel/analyses/d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f.html] ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html] ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Resources: Builder has an icon-toggle option. Siblings d5647efd and e03dd36f have no .rsrc section; sibling 040e0d76 includes four embedded RT_ICON resources (~114 KB total) plus RT_VERSION. ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]

See golang-stealer-build-pattern for the full build-pattern concept.

Deploy / TTPs

  • Execution: Standard Go runtime.main entry; Windows GUI subsystem, no console window.
  • Network: Statically linked net/http and crypto/tls imply HTTPS C2, but no hardcoded C2 URL was found in strings. C2 endpoints are decoded at runtime via a PRNG-seeded transform. ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html] ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Collection: Inferred from family label and shared build pattern with acrstealer / orderreshop: browser credential stores, cryptocurrency wallets, FTP/SSH sessions, and system information.
  • Process manipulation: syscall.LoadLibrary calls inside large main.* functions suggest module-loading or injection behaviour ^[r2:0x4889d0 decompilation] ^[r2:sym.main.pkuetur @ 0x489d80].
  • Anti-analysis: See fused-string-api-decoding — API names are fused with DLL names into indivisible .rdata blobs and sliced at runtime, defeating naive string extraction. ^[/intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html] ^[/intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html]
  • Memory staging: VirtualAlloc with PAGE_EXECUTE_READWRITE (0x3000, 0x40) observed in sym.main.cmvaso, consistent with reflective payload staging. ^[r2:sym.main.cmvaso @ 0x48afe0]

Capabilities

  • upx-compression
  • signed-pe-masquerade
  • signed-pe-masquerade-junk-cert
  • go-symbol-name-obfuscation
  • go-static-binary-no-cgo
  • trimpath-source-stripping
  • runtime-decoded-c2-urls
  • prng-seeded-c2-url-decoding
  • tls-https-c2-client
  • browser-credential-dumping
  • clipboard-hijack-cryptocurrency
  • keylogger-strings
  • cryptocurrency-wallet-targeting
  • module-loading-injection-routine
  • fused-string-api-decoding
  • icon-toggle-builder-option
  • letsencrypt-short-lived-cert
  • rwx-memory-alloc-staging
  • custom-stream-cipher-string-decoder
  • custom-in-memory-pe-parser
  • multi-pass-byte-transform-decoder
  • no-rsrc-section-variant
  • invalid-certificate-table-unsigned
  • placeholder-self-signed-cert
  • mid-density-randomized-namespace (~32 functions)
  • five-icon-rsrc-suite
  • dense-randomized-namespace-130-functions
  • high-density-randomized-namespace-71-functions (x64 morph, densest x64 namespace observed)
  • mid-density-randomized-namespace (~32 functions)
  • mid-density-randomized-namespace-47-functions — 47 randomized main.* functions (mid-density namespace, lighter than eaa52e19/9ca2ebb8 71-function dense builds)
  • unique-x64-text-template — .text hash does not match eaa52e19/9ca2ebb8/2f04e1e4 template cache; fresh build compilation
  • 1mb-null-padded-overlay — 1,050,752 null-byte overlay after .rsrc (builder padding artefact, largest overlay in Lumma x64 cluster)
  • go-pe32plus-x64-morph (first x64 build in cluster)
  • contested-acrstealer-attribution — sample c69b14a0 resolves to ACR cluster by cert chain
  • light-randomized-namespace (~27 functions, lightest in cluster)
  • go-goroutine-concurrency-in-main — first observed goroutine primitive in main payload path
  • go-anonymous-closure-func1 — .func1 closure emitted by compiler for goroutine/callback
  • go-pe32plus-x64-template-reuse-13e54677 — identical .text hash shared with eaa52e19 and 9ca2ebb8 (same x64 build cache)
  • two-goroutine-closures-main — two .func1 closures in main payload (pyocwfeeou, jtpisrathivs)
  • mid-light-randomized-namespace-30-functions — 30 randomized main.* functions (mid-light density)
  • 726kb-null-overlay — 726 KB overlay composed of 100% null bytes (builder padding artifact)
  • placeholder-self-signed-cert-xxxcom-e7 — placeholder self-signed cert CN=xxx.com / issuer E7 (observed in x64 cluster siblings eaa52e19, c25d9423, ae3ee04f, 9ca2ebb8, 2f04e1e4, ead52049)
  • three-month-cert-validity — shortest cert validity observed in Lumma cluster (May → Aug 2026)

Variants / Aliases

  • OpenCTI labels: lummastealer, exe, signed, sunwukong (label collision — see sunwukong)
  • Contested attribution: Sample c69b14a0 was labelled lummastealer by OpenCTI but carries the quiverquant.com/WE1 certificate chain of the acrstealer cluster. Certificate chain is the decisive discriminant; this sample belongs to ACR, not Lumma. See /intel/analyses/c69b14a0503d3cedeabb0131f533b44945502d41841152e5ebe8072417d1ff5f.html.
  • Confirmed cross-cluster bridge: ACR Stealer sibling 7620884e (Go 1.25.4, module rjVxxnjkTTMPaie) carries the identical blizzard-tecnica.com / R12 certificate chain, confirming shared signing infrastructure, builder, or operator. ^[/intel/analyses/7620884e50fd7741417ecdb81b41f7c7d9452b89d6905a837ad30a7bc8dc9969.html]

Notable Analyses

  • /intel/analyses/d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f.html — Go 1.25.4 PE32, module NZlhQRhWFITWnSR, cert CN=www.sjabr.org / issuer E8, no .rsrc, custom type names Altlrrq, Jhyfosq, etc.
  • /intel/analyses/e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3.html — Go PE32+ x64 sibling, same cert CN, no .rsrc, fused-string API decoder, PRNG C2 resolution
  • /intel/analyses/040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb.html — Go 1.25.4 PE32, module brIewNqtgMlfsdi, cert CN=blizzard-tecnica.com / issuer R12, has .rsrc icons, identical custom type names to d5647efd
  • /intel/analyses/90d54589bfae10deb74fa349668a5af649c546b8eddb75d5000174601920cf77.html — Go 1.25.4 PE32, module JuYWgOhherjqrZN, same cert CN=blizzard-tecnica.com / issuer R12, .rsrc icon present, adds custom in-memory PE parser and multi-pass byte-transform decoder (techniques previously seen in acrstealer sibling d5655568 and orderreshop). Confirms cross-cluster code reuse.
  • /intel/analyses/7b74bea75be45d0a798732cdb54674811c207a3b118960c2146e9e97fb35c94b.html — Go 1.25.4 PE32, module randomized, same cert CN=blizzard-tecnica.com / issuer R12, .rsrc icons present, standard PRNG C2 decoder variant (no custom PE parser / no multi-pass decoder). Lighter build; closer to 040e0d76. ^[/intel/analyses/7b74bea75be45d0a798732cdb54674811c207a3b118960c2146e9e97fb35c94b.html]
  • /intel/analyses/fa41d6b4e53c71633387a987d3bed687430e7a4e7b91e757e362fbbee7386e1f.html — Go 1.25.4 PE32, module sFSOHbxPocXzUlK, same cert CN=blizzard-tecnica.com / issuer R12, .rsrc icons present, custom in-memory PE parser + multi-pass byte-transform decoder (same technique suite as 90d54589), fresh randomized function names. Sixth confirmed sibling.
  • /intel/analyses/faa32ac2a1af9c0bdf39a6430313bdc3fe8b5e3e48d2d0a0cdecb96c960548c8.html — Go 1.23.0 PE32, module garbled (tecnica!!cnocor!!!/r!!!t), UPX-packed, no .rsrc, malformed/junk Authenticode signature block (not a valid cert), hardcoded C2 blizzard.digital:443, builder username sjabr in build path. No PRNG C2 decoder visible — C2 is plaintext in strings. Likely an older or lighter build variant predating the PRNG obfuscation layer. |- /intel/analyses/f04032b30bc54a3a01b2c013edeeca79e26337c95721f88cf3305f99626a6d0e.html — Go 1.25.4 PE32, module TGOSgqSAjDPjqLQ, same cert CN=blizzard-tecnica.com / issuer R12, no .rsrc, standard PRNG C2 decoder, no custom PE parser, no multi-pass decoder. Eighth confirmed sibling. Lighter build variant matching 7b74bea7 cert pattern but without icons.
  • /intel/analyses/46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c.html — Go 1.25.4 PE32, module ogsjkflrvz, same cert CN=blizzard-tecnica.com / issuer R12, no .rsrc, 51 randomized main.* functions, standard PRNG sleep gate (800–1120 s), RWX memory staging. Ninth confirmed Lumma-native sibling. Filename ws-Setup-Complete.exe social-engineering masquerade. |- /intel/analyses/142261c674f96c5b30d410b700f7153c1ddedcf0a1cd3b23bf6313cf416a2f17.html — Go 1.25.4 PE32, same cert CN=blizzard-tecnica.com / issuer R12 (inferred from cluster), five-icon .rsrc suite (16×16 through 256×256 RGBA), 92 randomized main.* functions (densest namespace in cluster), standard PRNG sleep gate (800–1120 s). Tenth confirmed Lumma-native sibling. ^[/intel/analyses/142261c674f96c5b30d410b700f7153c1ddedcf0a1cd3b23bf6313cf416a2f17.html] |- /intel/analyses/b3ffa06a189a3454d74ee20e24d7c6a4c49673c360d9fc7cc0423e263f0fcbf8.html — Go 1.25.4 PE32, module LkYepTgpfGoTJPv, invalid certificate table (security directory VA beyond EOF, no valid signing), 14-icon .rsrc suite (largest in cluster), 130 randomized main.* functions (densest namespace observed), standard PRNG sleep gate (800–1120 s). Eleventh confirmed Lumma-native sibling. Static-only. |- /intel/analyses/2120b8b7bf98e214fc99cb7c373382d0a04c3e3207a080c72876d4ba75e9943d.html — Go 1.25.4 PE32, module randomized, placeholder self-signed cert CN=xxx.com / 3-month validity, five-icon .rsrc suite (16×16 … 256×256 RGBA), 32 randomized main.* functions (mid-density namespace), standard fused-string API decoder. Twelfth confirmed Lumma-native sibling. Static-only. ^[/intel/analyses/2120b8b7bf98e214fc99cb7c373382d0a04c3e3207a080c72876d4ba75e9943d.html] |- /intel/analyses/eaa52e1968c4b8f8beb2fe508e9eea9beedd66964850e2383d2b56c5a3f98f51.html — Go 1.25.4 PE32+ x64 (second x64 morph in cluster; first was e03dd36f), placeholder self-signed cert CN=xxx.com / issuer E7 / 3-month validity, five-icon .rsrc suite, 71 randomized main.* functions (densest x64 namespace), 1 MB null-padded overlay (entropy 0.0367, 99.8% zeros), .text hash unique to x64 template. Thirteenth confirmed Lumma-native sibling. Static-only. ^[/intel/analyses/eaa52e1968c4b8f8beb2fe508e9eea9beedd66964850e2383d2b56c5a3f98f51.html]

|- /intel/analyses/c25d942315b926dab7c1a3aff907891b0f3c7db6ff809d3399b6af6c4d389c67.html — Go 1.25.4 PE32+ x64 (fourteenth x64 morph), placeholder self-signed cert CN=xxx.com / issuer E7, five-icon .rsrc suite, 27 randomized main.* functions (lightest namespace in cluster), new goroutine concurrency primitive (main.xregypl + .func1 closure), standard PRNG sleep gate, RWX VirtualAlloc reflective loader, fused-string API decoder. First goroutine-based concurrency observed in cluster. Static-only. ^[/intel/analyses/c25d942315b926dab7c1a3aff907891b0f3c7db6ff809d3399b6af6c4d389c67.html]

|- /intel/analyses/ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.html — Go 1.25.4 PE32+ x64 (fifteenth confirmed sibling), placeholder self-signed cert CN=xxx.com / issuer E7, five-icon .rsrc suite (16×16 … 256×256 RGBA), 63 randomized main.* functions (mid-to-high density namespace), no null-padded overlay, .text hash unique to this build. Standard PRNG C2 decoder and fused-string API decoding inferred from cluster pattern. Static-only. ^[/intel/analyses/ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.html]

|- /intel/analyses/9ca2ebb826a8d0de58eea5a1afb5f6f76adb3938feef9604725508452b0a2e08.html — Go 1.25.4 PE32+ x64 (sixteenth confirmed sibling), placeholder self-signed cert CN=xxx.com / issuer E7, five-icon .rsrc suite (16×16 … 256×256 RGBA), 71 randomized main.* functions (densest x64 namespace, matching eaa52e19), 726 KB null-padded overlay (entropy 0.0516, 99.7% zeros), main.tehakink.func1 goroutine closure, .text hash unique. Standard PRNG sleep gate and fused-string API decoder inferred. Static-only. ^[/intel/analyses/9ca2ebb826a8d0de58eea5a1afb5f6f76adb3938feef9604725508452b0a2e08.html]

|||- /intel/analyses/2f04e1e48d9db645118b69c7d55dfe2b3a21a12f7ecd70bcb26840b73557784d.html — Go 1.25.4 PE32+ x64 (seventeenth confirmed sibling), placeholder self-signed cert CN=xxx.com / issuer E7, five-icon .rsrc suite, 30 randomized main.* functions (mid-light density), 726 KB null-padded overlay (100% zeros, entropy 0.0), identical .text hash to eaa52e19 and 9ca2ebb8 (same x64 template/build cache), two goroutine closures (main.pyocwfeeou.func1 and main.jtpisrathivs.func1). Static-only. ^[/intel/analyses/2f04e1e48d9db645118b69c7d55dfe2b3a21a12f7ecd70bcb26840b73557784d.html]

||||- /intel/analyses/ead52049a68c24e8538cd7763e59414f4b6561d458fab3bafd719543ce037025.html — Go 1.25.4 PE32+ x64 (eighteenth confirmed sibling), placeholder self-signed cert CN=xxx.com / issuer E7, five-icon .rsrc suite (16×16 … 256×256 RGBA), 47 randomized main.* functions (mid-density namespace), 1 MB null-padded overlay (entropy 0.0, 100% zeros), unique .text hash (does not match the eaa52e19 / 9ca2ebb8 / 2f04e1e4 template cache — fresh build compilation). Standard PRNG sleep gate and fused-string API decoder inferred. Static-only. ^[/intel/analyses/ead52049a68c24e8538cd7763e59414f4b6561d458fab3bafd719543ce037025.html]

||Contested ACR-attribution samples on the Lumma label:

  • c69b14a0 — carries quiverquant.com/WE1 cert (ACR cluster), not Lumma-native. See acrstealer entity.
  • 3f7d51dd — carries quiverquant.com/WE1 cert (ACR cluster), OpenCTI label lummastealer; resolves to ACR by certificate chain. Go 1.25.4 PE32, module rPNTPRIvOgSxctC, 42 randomized main.* functions, no .rsrc. Static-only.

Related