Virus Tracker

Blog

  • Lumma Infostealer: New Distribution Campaign Analysis

    Our tracking infrastructure detected a new distribution campaign for the Lumma infostealer beginning on April 8. The initial delivery vector is SEO-poisoned search results leading to fake software download pages. The pages serve a trojanized installer that drops the Lumma payload via a multi-stage loader.

    Distribution Infrastructure

    We have identified 23 distribution domains registered within a 48-hour window through the same registrar. All domains follow a similar pattern: legitimate software name combined with terms like “download”, “free”, or “crack”. The landing pages are well-crafted copies of legitimate software sites.

    Infection Chain

    The infection proceeds in three stages. First, the user downloads what appears to be a software installer (typically 15-25 MB). The installer is a legitimate NSIS package with an embedded encrypted payload. On execution, the installer drops a small loader binary to the user’s AppData directory.

    Second, the loader contacts one of four hardcoded C2 domains to retrieve a configuration blob. The blob contains the URL for the final payload and an XOR key for decryption.

    Third, the final Lumma payload is downloaded, decrypted, and injected into a legitimate Windows process via process hollowing. The Lumma instance then begins credential harvesting from browsers, cryptocurrency wallets, and FTP clients.

    Indicators of Compromise

    Distribution domains, loader hashes, and C2 infrastructure details are listed below. We recommend blocking these at the DNS and network level.

    Loader SHA256: a7b3f2e84c1d…[truncated for safety]

    C2 Domains: download-helper[.]xyz, softget-free[.]com, appinstall-now[.]net, getsoft-dl[.]org

  • Raccoon Stealer v3: What Changed and What Stayed the Same

    Raccoon Stealer returned in mid-2023 after a period of inactivity following the arrest of one of its operators. Version 3 represents a significant rewrite of the malware, but several core behaviors remain unchanged, making tracking and detection feasible for organizations that had existing signatures.

    What Changed

    Communication Protocol: v3 switched from HTTP-based C2 communication to a custom binary protocol over TCP. The protocol uses a simple handshake followed by encrypted data exchange. This change makes network-level detection more difficult but also makes the traffic more conspicuous on networks that monitor for unusual TCP connections.

    Credential Extraction: The browser credential extraction module was completely rewritten. v3 supports Chromium-based browsers using the new App-Bound Encryption introduced in Chrome 127, which v2 could not bypass. It also added support for extracting passwords from the macOS Keychain.

    Anti-Analysis: v3 includes more aggressive anti-sandbox checks, including timing-based detection that measures instruction execution speed to identify virtual environments. Our analysis sandbox required modifications to bypass these checks.

    What Stayed the Same

    Configuration Format: Despite the protocol changes, the configuration blob format is largely unchanged. This means existing tools for extracting C2 addresses from Raccoon configs still work with minor modifications.

    File Collection: The file grabber module uses the same directory traversal and extension matching logic. The default target extensions (wallet files, documents, images) are identical to v2.

    Exfiltration: Stolen data is still packaged into a ZIP archive before exfiltration. The archive structure is the same, making it possible to identify Raccoon exfiltration in network traffic by the archive signature pattern.