# Lumma Stealer Configuration

**URL:** <https://community.emergingthreats.net/t/lumma-stealer-configuration/685>\
**Category:** Rule Signatures\
**Created:** [June 22, 2023, 10:22pm UTC](https://community.emergingthreats.net/t/lumma-stealer-configuration/685 "2023-06-22T22:22:33Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [September 15, 2023, 12:58am UTC](https://community.emergingthreats.net/t/lumma-stealer-configuration/685/4 "2023-09-15T00:58:48Z")

</div>

Hi, we have updated Lumma http post and wrote new rules

```auto
alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In";flow: established, to_server; http.method;content: "POST"; http.request_body;content: "act="; depth: 4;content: "&lid="; distance: 0;content: "&j="; distance: 0;content: "&ver="; distance: 0; isdataat: !5, relative; classtype: command-and-control; reference: md5,884478741e7046e6d0788b63c09df89f; reference: url, app.any.run/tasks/409f5138-3853-4910-80d4-3c380b969274; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family Lumma, created_at 2023_09_15; sid: 1; rev: 1;)

```

This is the general rule for check-in. Now I’ll write for exfiltration

```auto
alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration";flow: established, to_server; http.method;content: "POST"; http.request_body;content: "Content-Disposition: form-data|3b 20|name=|22|act|22 0d 0a 0d 0a|send_message|0d 0a|--"; content: "Content-Disposition: form-data|3b 20|name=|22|hwid|22 0d 0a 0d 0a|"; content: "Content-Disposition: form-data|3b 20|name=|22|lid|22 0d 0a 0d 0a|"; content: "Content-Disposition: form-data|3b 20|name=|22|file|22 3b|"; threshold:type limit, seconds 30, count 1, track by_dst; classtype: command-and-control;reference: md5,884478741e7046e6d0788b63c09df89f;reference: url,app.any.run/tasks/409f5138-3853-4910-80d4-3c380b969274;metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family Lumma, created_at 2023_09_15;sid: 2; rev: 1;)

```

> **[Analysis https://randsoms.click Malicious activity - Interactive analysis...](https://app.any.run/tasks/66dd3186-985c-4510-aad2-08036aa6ce49/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

> **[Analysis 37788c18a5d82e5f1a331915e80a91c024d90efc8f695b7850aa0dcdb8964a54...](https://app.any.run/tasks/cb20f43e-7d00-4357-beb4-f4211a9b1b9f/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

I didn’t write any extra rules, We’ll keep an eye on further changes. Thanks @g0njxa!  
Best regards, Jane

---

_[View the full topic](https://community.emergingthreats.net/t/lumma-stealer-configuration/685)._