We are releasing a set of YARA rules for detecting the current Lumma packer variant. The packer uses a distinctive XOR-based string decryption routine with a rotating 16-byte key, which produces a recognizable pattern in the .rdata section.
Detection Approach
The current Lumma packer has three identifying characteristics that our rules target. First, a specific sequence of XOR instructions in the unpacking stub that uses a rotating key stored at a fixed offset from the entry point. Second, a distinctive .rdata section structure where encrypted strings are stored in 64-byte aligned blocks. Third, an import table that includes VirtualAlloc, VirtualProtect, and NtWriteVirtualMemory in a specific order.
Rule Performance
These rules have been tested against our sample collection of 847 confirmed Lumma samples and 12,000 clean files with zero false positives. Detection rate against our Lumma collection is 94.2% – the remaining 5.8% are older variants that use a different packing method.
Usage Notes
These rules complement the existing Lumma signatures from StrangerealIntel and should be used alongside them rather than as replacements. The rules are designed for scanning files on disk rather than in-memory detection. For memory scanning, additional rules targeting the unpacked payload are recommended.
The YARA rules are available on our GitHub repository and will be updated as new packer variants are identified.