LummaC2 Malware Deploys New Trigonometry-Based Anti-Sandbox Technique

The stealer malware recognised as LummaC2 (aka Lumma Stealer) now options a new anti-sandbox procedure that leverages the mathematical theory of trigonometry to evade detection and exfiltrate useful facts from infected hosts.

The technique is designed to “delay detonation of the sample till human mouse activity is detected,” Outpost24 security researcher Alberto Marín said in a specialized report shared with The Hacker News.

Created in the C programming language, LummaC2 has been marketed in underground community forums due to the fact December 2022. The malware has due to the fact gained iterative updates that make it more challenging to examine by using control move flattening and even allow for it to deliver additional payloads.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The present-day edition of LummaC2 (v4.) also needs its customers to use a crypter as an extra concealing system, not to point out avoid it from getting leaked in its raw sort.

Yet another noteworthy update is the reliance on trigonometry to detect human habits on the infiltrated endpoint.

“This method will take into thought various positions of the cursor in a shorter interval to detect human action, effectively stopping detonation in most investigation units that do not emulate mouse actions realistically,” Marín claimed.

To do so, it extracts the present cursor placement for five instances following a predefined interval of 300 milliseconds, and checks if every captured place is distinctive from its previous 1. The procedure is recurring indefinitely till all consecutive cursor positions differ.

As soon as all the five cursor positions (P0, P1, P2, P3, and P4) meet up with the necessities, LummaC2 treats them as Euclidean vectors and calculates the angle which is formed concerning two consecutive vectors (P01-P12, P12-P23, and P23-P34).

“If all the calculated angles are decreased than 45º, then LummaC2 v4. considers it has detected ‘human’ mouse actions and proceeds with its execution,” Marín stated.

“Even so, if any of the calculated angles is more substantial than 45º, the malware will start off the system all in excess of yet again by making certain there is mouse motion in a 300-millisecond period and capturing once more 5 new cursor positions to procedure.”

The advancement arrives amid the emergence of new strains of information stealers and distant accessibility trojans such as BbyStealer, Trap Stealer, Predator AI, and Sayler RAT that are made to extract a large variety of sensitive knowledge from compromised units.

Predator AI, an actively preserved task, is also notable for the simple fact that it can be made use of to attack several preferred cloud companies such as AWS, PayPal, Razorpay, and Twilio, in addition to incorporating a ChatGPT API to “make the device much easier to use,” SentinelOne mentioned earlier this thirty day period.

“The malware-as-a-assistance (MaaS) model, and its conveniently offered plan, continues to be to be the most popular system for emerging threat actors to have out elaborate and rewarding cyberattacks,” Marín stated.

“Data theft is a significant concentration within just the realm of MaaS, [and] represents a considerable danger that can direct to considerable economical losses for the two organizations and individuals.”

Observed this posting appealing? Follow us on Twitter  and LinkedIn to study extra distinctive content we publish.