Lumma Stealer on the Rise: How Telegram Channels Are Fueling Malware Proliferation

Authored by: M, Mohanasundaram and Neil Tyagi

In at present’s quickly evolving cyber panorama, malware threats proceed to adapt, using new ways and leveraging common platforms to achieve unsuspecting victims. One such rising menace is the Lumma Stealer—a potent information-stealing malware lately gaining traction by means of Telegram channels. With Telegram’s recognition as a messaging and sharing platform, menace actors have recognized it as a profitable distribution vector, bypassing conventional detection mechanisms and reaching a broad, usually unsuspecting viewers.

Luckily, McAfee’s superior safety options are geared up to detect and mitigate threats like Lumma Stealer. By cutting-edge menace intelligence, behavioral evaluation, and real-time monitoring, McAfee gives strong defenses in opposition to this malware, serving to customers safe their private knowledge and digital property. On this weblog, we’ll discover the ways, strategies, and procedures (TTPs) utilized by Lumma Stealer, study its capabilities, and talk about how McAfee options can assist safeguard customers from this quickly spreading menace.

• Telegram channel providing malware disguised as crack software program
• https[:]//t[.]me/hitbase
• Discover the excessive subscriber rely of 42k.
• Final put up on 3^rd Nov

• One other instance of a telegram channel providing malware to benign customers.
• https[:]//t[.]me/sharmamod
• Subscriber rely 8.66k
• Final put up on 3^rd Nov

• Additionally discover that each the channels are associated as they’re forwarding messages from one another’s telegram channel.
• McAfee detects these faux crack software program as [Trojan:Win/Lummastealer.SD]
• Menace Prevalence noticed as per McAfee telemetry knowledge.
• India is most affected by this menace, adopted by the USA and Europe.

• This weblog will dissect one particular file, CCleaner 2024.rar. The others are related in nature apart from the theme.
• The hash for this file is 3df7a19969e54bd60944372e925ad2fb69503df7159127335f792ad82db7da0b.

• The extracted rar accommodates Microsoft DLL information

• Readme.txt accommodates the hyperlink to the telegram channel

• CCleaner 2024.exe is a .NET utility

• We load the file into Dnspy and test the principle operate.

• On this, we have now two calls to a operate UninitializeBuilder, which decrypts the blob of knowledge that’s handed to it (AIOsncoiuuA & UserBuffer) together with the important thing (Alco and key).

• Decryption Key (Alco) and Encrypted knowledge (AIOsncoiuuA) for the primary name.

• Decryption Key (Key) and Encrypted knowledge (UserBuffer) for the Second name.

• Snippet of the decryption Operate.

• Decrypted knowledge is saved into variable uiOAshyuxgYUA.
• We put a breakpoint on the top of this operate and run this system to get the decrypted worth of every name.
• For the primary name, we get the next decrypted knowledge in reminiscence. We see course of injection API calls have been decrypted in reminiscence.

• We are able to additionally see the goal program by which the method injection will happen, on this case, RegAsm.exe.
• We are able to verify this by means of the method tree.

• We let the breakpoint hit once more to get the following layer decrypted PE file

• We are able to observe the decrypted PE bytes, dump this payload to disk, and examine the following stage.
• Stage1 is a V C++ compiled file.

• We checked the payload sections and found that it holds encrypted knowledge.

• Snippet of the decryption loop.

• Following decryption, the info is written to 2 information within the AppData Roaming folder.

• The primary payload written within the AppDataRoaming folder is the .NET file “XTb9DOBjB3.exe”(Lumma_stealer) and the second payload additionally .Internet file “bTkEBBlC4H.exe”(clipper).

• Upon inspecting each payloads, we noticed that they make use of the identical decryption logic as the principle file(ccleaner).

Lumma stealer:

• After dumping the payload from the .NET file, we found it’s a 32-bit GUI Moveable Executable.
• “winhttp.dll is dynamically loaded into this system utilizing the LoadLibraryExW operate.

• Upon inspecting the PE file, Base64-encoded strings have been recognized throughout the binary.

• The encoded knowledge is first decoded from Base64 format, changing it again into binary. The decoded knowledge is then handed by means of a decryption routine to get better the plaintext.

• We observe that the Plaintext resembles a website, and it’s used to determine communication with a menace actor to exfiltrate the info.

• Code snippet for WinHttpOpenRequest:

Record of Requests with put up methodology:

• “hxxps://snarlypagowo.web site/api”
• “hxxps://questionsmw.retailer/api”
• “hxxps://soldiefieop.web site/api”
• “hxxps://abnomalrkmu.web site/api”
• “hxxps://chorusarorp.web site/api”
• “hxxps://treatynreit.web site/api”
• “hxxps://mysterisop.web site/api”
• “hxxps://absorptioniw.web site/api”

Finally, it connects to the steam neighborhood

• (hxxps://steamcommunity.com/profiles/76561199724331900),

The malware extracts the Steam account title, initially obfuscated to evade detection, and decodes it to disclose the C2 area. This step is important for establishing a connection between the compromised gadget and the attacker’s server, permitting additional malicious exercise comparable to knowledge exfiltration and extra payload supply. By utilizing this method, the attackers successfully bypass primary detection mechanisms, making it tougher for conventional safety options to determine the communication with the C2 server.

• That is the snippet of the Steam neighborhood:

• Upon checking the info, it was noticed that the consumer’s title was obfuscated and had many aliases. We noticed that the actual_persona_name fetched and it deobfuscated by the beneath code.

• Upon de-obfuscation, we discovered the plain textual content and its area “marshal-zhukov.com”.

• Upon establishing a connection, the C2 server responded with configuration knowledge in Base64 encoded format. The encoded knowledge is first decoded from Base64 format, changing it again into binary. The decoded knowledge is then handed by means of a decryption routine to get better the plaintext.

• Config for accumulating pockets data.

• For FTP and e mail data:

• It additionally collects system data and sends it to c2.

• Clipper:
• As soon as we dumped the payload from the .NET file, we discovered that it was a 32-bit .NET executable named “Runtime64.exe.”

• We load the file into dnspy and test the principle operate.

• It begins by checking the mutex(“sodfksdkfalksdasgpkprgasdgrrkgwhrterheegwsdfwef”) to see if it’s already working on the machine.
• Autorun.is_installed: This operate checks if this system is ready to run on system startup. If autorun isn’t configured, it provides one to allow computerized execution on startup.

• This file units the hidden attribute to false to take away the hidden standing and set it as a system file to guard it.

• This Clipboard Monitor.run operate Makes use of the next regex patterns to match the pockets addresses.

• If it matches, it replaces the clipboard content material with the desired deal with to hijack the cryptocurrency.

• Code snippet for clipboard monitor and alternative:

Conclusion

The Lumma Stealer is a stark reminder of the ever-evolving nature of cyber threats and the speedy adaptability of malware ways. Its unfold by means of Telegram channels demonstrates how simply menace actors can exploit common platforms to distribute malicious code to a broad viewers. With Lumma Stealer able to stealing delicate data and compromising consumer privateness, the potential harm it may possibly trigger is critical.

On this more and more harmful cyber panorama, having strong, up-to-date safety has by no means been extra essential. McAfee’s superior menace detection and proactive protection mechanisms present customers with an important safeguard in opposition to such threats. By combining real-time monitoring, behavioral evaluation, and steady updates to counter new TTPs, McAfee helps customers keep one step forward of malicious actors. As TTPs evolve quickly, sustaining complete antivirus safety is important to safeguarding private knowledge, monetary data, and privateness. Staying vigilant and geared up with the right safety options ensures that customers are ready to face the newest threats head-on.

Indicators of Compromise

Introducing McAfee+

Id theft safety and privateness in your digital life

Obtain McAfee+ Now