user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:Win32/LummaStealer
Trojan:Win32/LummaStealer - Windows Defender threat signature analysis

Trojan:Win32/LummaStealer - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:Win32/LummaStealer
Classification:
Type:Trojan
Platform:Win32
Family:LummaStealer
Detection Type:Concrete
Known malware family with identified signatures
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for 32-bit Windows platform, family LummaStealer

Summary:

Trojan:Win32/LummaStealer is a high-impact information-stealing malware designed to harvest sensitive data from compromised systems. It targets credentials from web browsers, cryptocurrency wallets, system information, and other personal files, exfiltrating the stolen data to attacker-controlled servers. The detection is concrete and corroborated by external threat intelligence, indicating an active and dangerous threat.

Severity:
Critical
VDM Static Detection:
No specific strings found for this threat
YARA Rule:
rule Trojan_Win32_LummaStealerClick_A_2147931073_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Trojan:Win32/LummaStealerClick.A!MTB"
        threat_id = "2147931073"
        type = "Trojan"
        platform = "Win32: Windows 32-bit platform"
        family = "LummaStealerClick"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_CMDHSTR_EXT"
        threshold = "5"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "powershell" wide //weight: 1
        $x_1_2 = "-split ($" wide //weight: 1
        $x_1_3 = ".CreateDecryptor(" wide //weight: 1
        $x_1_4 = "-replace" wide //weight: 1
        $x_1_5 = ".Substring(" wide //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: 29cf552bb9d43c9e2a102756f15eeeefb423bb2ecc1182a6505654da79bf1dd0
29cf552bb9d43c9e2a102756f15eeeefb423bb2ecc1182a6505654da79bf1dd0
21/05/2026
→VirusTotal↓Download Sample
Filename: WindowsCodecs.dll
30ef7cbd5835c6d6e8b014f6658905797bfcb278ed1bc1282e77f10a9a1d357a
12/05/2026
→VirusTotal↓Download Sample
Filename: setup
001a10b946d41f8794c110f97cd46b961fea0c0d50c92efaef1d166adaffe8b8
26/04/2026
→VirusTotal↓Download Sample
Filename: setup
5f55c1e837b6fbe5d81d93983166f34f3471a7f20af28ff527b9f140a601ce2d
16/04/2026
→VirusTotal↓Download Sample
Filename: NovaViewer.exe
5fa5a32476d1e677e544e27d795a8c627b5ed9adf210d5c9b9626c1173115a62
27/03/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected endpoint from the network to prevent further data exfiltration or lateral movement. Run a full antivirus scan to remove all malicious components. Since this is an information stealer, reset all passwords and invalidate session tokens for any accounts accessed from the compromised machine, and closely monitor for fraudulent activity.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 15/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊