LummaC2 Malware Deploys New Trigonometry-Based Anti-Sandbox Technique

The stealer malware recognized as LummaC2 (aka Lumma Stealer) now characteristics a new anti-sandbox technique that leverages the mathematical theory of trigonometry to evade detection and exfiltrate valuable data from infected hosts.

The strategy is made to “hold off detonation of the sample until human mouse activity is detected,” Outpost24 security researcher Alberto Marín said in a specialized report shared with The Hacker News.

Published in the C programming language, LummaC2 has been bought in underground message boards considering that December 2022. The malware has because acquired iterative updates that make it more difficult to evaluate by using management movement flattening and even let it to deliver supplemental payloads.

The existing version of LummaC2 (v4.) also needs its clients to use a crypter as an extra concealing mechanism, not to mention stop it from currently being leaked in its uncooked variety.

Another noteworthy update is the reliance on trigonometry to detect human actions on the infiltrated endpoint.

“This technique takes into thing to consider different positions of the cursor in a small interval to detect human activity, properly preventing detonation in most evaluation devices that do not emulate mouse movements realistically,” Marín claimed.

To do so, it extracts the current cursor placement for five periods immediately after a predefined interval of 300 milliseconds, and checks if each and every captured posture is various from its preceding one particular. The course of action is repeated indefinitely until all consecutive cursor positions differ.

At the time all the 5 cursor positions (P0, P1, P2, P3, and P4) satisfy the prerequisites, LummaC2 treats them as Euclidean vectors and calculates the angle that is formed between two consecutive vectors (P01-P12, P12-P23, and P23-P34).

“If all the calculated angles are lessen than 45º, then LummaC2 v4. considers it has detected ‘human’ mouse behavior and carries on with its execution,” Marín mentioned.

“However, if any of the calculated angles is greater than 45º, the malware will start out the procedure all above again by ensuring there is mouse movement in a 300-millisecond interval and capturing all over again 5 new cursor positions to method.”

The advancement will come amid the emergence of new strains of information stealers and distant entry trojans these as BbyStealer, Trap Stealer, Predator AI, and Sayler RAT that are made to extract a large assortment of sensitive knowledge from compromised methods.

Predator AI, an actively managed undertaking, is also noteworthy for the reality that it can be utilized to attack several preferred cloud providers such as AWS, PayPal, Razorpay, and Twilio, in addition to incorporating a ChatGPT API to “make the instrument easier to use,” SentinelOne observed earlier this thirty day period.

“The malware-as-a-service (MaaS) model, and its readily available scheme, continues to be to be the preferred process for rising danger actors to have out sophisticated and worthwhile cyberattacks,” Marín explained.

“Information and facts theft is a major concentration within just the realm of MaaS, [and] represents a sizeable threat that can lead to sizeable economical losses for both organizations and men and women.”

Uncovered this post appealing? Adhere to us on Twitter  and LinkedIn to study more unique material we publish.

Some parts of this article are sourced from:
thehackernews.com