Researchers observed Lumma Stealer activity across multiple online samples, including PowerShell scripts and a disguised EXE installer, as analysis revealed a parent-child relationship between these samples, all of which communicated with the same C2 server.
The Lumma Stealer Trojan, observed in the provided sample, employs advanced techniques to exfiltrate sensitive data from popular browsers and applications, which targets a wide range of information, including browser credentials, cryptocurrency wallet details, and user profiles from platforms like Steam and Discord, posing a significant threat to user privacy and security.
.webp)
The collection includes three files: a PowerShell script (“Trigger.ps1”), another PowerShell script (“BMB1tcTf.txt”) significantly larger in size, and an executable (“hhh.exe”), while SHA1 hashes are provided for each file for identification and integrity verification.
Trigger.ps1 is a PowerShell script that downloads a file (BMB1tcTf.txt) and executes it if the environment is legitimate, which appears to be malicious as it attempts to download and execute another file (hhh.exe).
The malware sample, identified as GHOSTPULSE, gathers system information including operating system details, hardware specifications, loaded modules, and active processes after execution.
It creates a new process using more.com (an MS DOS command to display text content) and injects its payload using the Process Doppelgänging technique and then drops two files: one named more.com and another with a random lowercase letter combination filename.
Malware disguised as an AutoIt script (AutoIt3.exe) was delivered and contained a PNG image embedded with a malicious payload using the Ghostpulse technique, where the extracted payload indicates it can steal cryptocurrency and password-related data.
.webp)
According to Tianqiong sandbox analysts, Lumma Stealer is a Trojan that uses process injection (Heaven’s Gate technique) to execute 32-bit APIs in a 64-bit environment to steal system information, clipboards, browser passwords, etc. and send it to the C2 server.
It utilizes a multipart/form-data communication protocol with a unique boundary string to exfiltrate sensitive data, such as Firefox passwords, by establishing a session with a C2 server using a specific lifeID and transmitting stolen data in a compressed format, demonstrating advanced evasion techniques.
