ThreatFox: Lumma Stealer IOCs

Hunt Hypothesis

This hunt identifies potential compromises involving Lumma Stealer, a prevalent infostealer that exfiltrates sensitive data such as credentials and cryptocurrency wallet information. Proactively hunting for these IOCs in Azure Sentinel is critical to detect early-stage intrusion attempts and prevent lateral movement or data exfiltration before the adversary achieves their objectives.

IOC Summary

Malware Family: Lumma Stealer Total IOCs: 8 IOC Types: url, sha256_hash, ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Lumma Stealer
let malicious_ips = dynamic(["94.26.83.69"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.26.83.69"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Lumma Stealer
let malicious_domains = dynamic(["gemscocl.com", "astroflowsystems.lol", "ninjamysticblade.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Lumma Stealer
let malicious_urls = dynamic(["https://gemscocl.com/nfront.php", "https://gemscocl.com/nback.php", "http://94.26.83.69/panel/pb-fire"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Lumma Stealer
let malicious_hashes = dynamic(["d98637ad8c87336f9e8a9789802d01fa76c60afc1d0cf1273a96eebfc48697ca"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Lumma Stealer

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a new microservice, where the build artifact or container image contains a specific string hash or URL listed in the Lumma Stealer IOCs (e.g., a shared library path or a staging API endpoint).

  • Filter/Exclusion: Exclude events where the source process is a known build tool (e.g., docker.exe, kubectl.exe, git.exe) or where the parent process chain includes a CI/CD agent (e.g., agent.exe, jenkins-slave.exe).

• Scenario: An IT administrator performs a manual software installation or update using a package manager (e.g., winget, choco, or dnf) that downloads a component from a repository URL that coincidentally matches one of the Lumma Stealer C2 domains or IP addresses (e.g., a public CDN or a self-hosted Nexus/Artifactory server).

  • Filter/Exclusion: Exclude network connections or file creations where the initiating process is a known package manager or installer (e.g., winget.exe, choco.exe, msiexec.exe) and the destination path is within standard program directories (e.g., C:\Program Files\, C:\ProgramData\).

• Scenario: A security team runs a vulnerability scanner (e.g., Nessus, Qualys, or Tenable.io) that probes internal hosts using a custom script or plugin that references a known Lumma Stealer IOC (e.g., a specific user-agent string, a test payload file, or a known C2 beacon simulation) to verify detection coverage.

  • Filter/Exclusion: Exclude events where the source process is a known scanning tool (e.g., nessus.exe, qualys-agent.exe, `ten