LummaC2 Employs Trigonometry to Track Mouse Movements

MaaS (Malware-as-a-Provider) flourishes as a top option for fresh cyber threats, offering rapid entry to highly efficient instruments. Likelihood actors essentially take care of knowledge theft underneath Maas, focusing on stealing and leaking quiet recordsdata from hacked devices.

This malicious behavior poses a principal threat to both folks and agencies, with the aptitude to space off essential financial losses.

Now not too lengthy within the past, the cybersecurity researchers at Outpost24’s KrakenLabs found LummaC2 v4.0 evading sandboxes with a fresh Anti-Sandbox trick.

Apart from this, the threat actor within the encourage of the “LummaC2 v4.0,” warns in opposition to spreading malware unchanged.

LummaC2 v4.0

LummaC2, a C-written recordsdata-stealer, hit underground markets in Dec 2022 and is now at version 4.0 with the following updates:-

• Assign watch over Drag Pulling down
• Original Anti-Sandbox plot
• Strings are actually XOR encrypted
• Helps dynamic configuration recordsdata retrieved from the C2
• Enforces threat actors to use a crypter for their builds

The utilization of Trigonometry to Detect Mouse Movements

Throughout the malware evaluation, researchers chanced on two particular layers, and the layers were described as:-

• Layer 1: This deposit employs assembly junk, diverse in packed samples, nonetheless lacks meaningful execution. The Push+ret and jz+jnz are examples of obfuscation that stops disassembly and makes the evaluation extra significant.

• Layer 2: This deposit mirrors the principle, employing same obfuscation to restrict disassembly. It extracts, decrypts, and runs LummaC2 v4.0 by loading a hardcoded resource (‘3’) the utilization of LoadResource and LockResource.

Assign watch over Drag Pulling down disrupts program float and complicates the evaluation since it’s an obfuscation plot. Opaque predicates introduce complexity thru conditional jumps, putting forward program acceptance.

Listless code entails sluggish or unreachable factors. LummaC2 v4.0 uses calls to identified routines with invalid parameters in some boring code blocks.

Facing this obfuscation entails recognizing the well-known dispatcher, key blocks (relish Block 1 and Block 2), and the predispatcher. The most principal dispatcher is the do execution returns.

Predispatcher alters parameters to recordsdata execution. Figuring out blocks is tricky with CFF. LummaC2 v4.0 stores lend a hand watch over float values in native variables or register-pointed memory areas.

LummaC2 v4.0 introduces a selected anti-sandbox tactic, delaying execution until it detects realistic mouse movements. It captures cursor positions, then exams for consecutive differences, and uses trigonometry to title ‘human’ behavior.

The route of repeats until actual mouse process is detected, combating detonation in much less realistic sandbox environments.

More recent LummaC2 v4.0 variations cease unpacked pattern leaks by detecting if the executable is crypted. If now not crypted, it displays an alert, allowing users to cease execution with out hurt.

IOCs

Hashes

• LummaC2 v4.0 (pattern 1)

• b14ddf64ace0b5f0d7452be28d07355c1c6865710dbed84938e2af48ccaa46cf (packed)
• 4408ce79e355f153fa43c05c582d4e264aec435cf5575574cb85dfe888366f86 (unpacked)

• LummaC2 v4.0 (pattern 2)

• de6c4c3ddb3a3ddbcbea9124f93429bf987dcd8192e0f1b4a826505429b74560 (packed)
• 976c8df8c33ec7b8c6b5944a5caca5631f1ec9d1d528b8a748fee6aae68814e3 (unpacked)

C&Cs

• curtainjors[.]enjoyable
• gogobad[.]enjoyable
• superyupp[.]enjoyable