The LummApp campaign (discovered by Team Axon in October 2024) distributes malicious MSI installers via cracked-software sites and Mega.nz ZIPs to deploy a Lumma-based infostealer and a heavily obfuscated browser extension. It leverages DLL sideloading of trusted signed executables, encoded PowerShell, and process injection to steal credentials, capture screenshots, and exfiltrate data to attacker-controlled domains. #LummApp #TeamAxon
Keypoints
- LummApp is distributed through cracked-software/torrent sites and Mega.nz ZIPs containing MSI installers that deploy malicious components.
- The MSI creates an AppData directory, unpacks a malicious DLL (using UnRAR.exe), and uses DLL sideloading of signed binaries (e.g., obs-ffmpeg-mux.exe) to execute payloads.
- The malicious DLL injects a Lummac2 executable into explorer.exe to perform screenshot capture, host enumeration, targeted file searches (wallets, mail clients, .kdbx), and credential theft from browsers.
- Encoded and obfuscated PowerShell stages download and reconstruct a randomly named browser extension in AppData, using large base64 arrays and character-replacement obfuscation to evade detection.
- Stolen data is exfiltrated to multiple attacker domains (e.g., Gulbur[.]com, Hit-bone[.]com), and the final browser extension provides extensive data collection and real-time capabilities (WebSocket, screenshot, input capture).
- IOCs include specific domain names, a malicious URL endpoint, and DLL hashes (avcodec-60.dll variants); recommended mitigations include uninstalling suspicious apps and removing unknown browser extensions.
MITRE Techniques
- [T1574.001] DLL Side-Loading – The campaign places a malicious DLL in AppData and relies on vulnerable signed executables to load it (‘vulnerable to a DLL sideloading exploit’ / ‘By exploiting legitimate DLLs associated with trusted OBS-signed files’).
- [T1059.001] PowerShell – Attack stages execute heavily obfuscated and encoded PowerShell commands to download and reconstruct the browser extension (‘Executes encoded PowerShell commands as part of the attack’s next stage to deploy malicious browser extension’).
- [T1055] Process Injection – The malicious DLL injects a Lummac2 executable into explorer.exe to run subsequent payloads under a trusted process (‘the malicious DLL injects a Lummac2 executable into explorer.exe’).
- [T1113] Screen Capture – The injected process captures screenshots of the host environment as part of data collection (‘Takes a screenshot of the host environment’).
- [T1555.003] Credentials from Web Browsers – The malware extracts cookies and stored passwords from installed browsers (‘Extracts cookies and stored user passwords from installed web browsers’).
- [T1041] Exfiltration Over C2 Channel – Collected data is sent to attacker-controlled domains for remote retrieval (‘The collected data is then exfiltrated to external domains… Gulbur[.]com, Hit-bone[.]com, L-back[.]com, Livedjudhr[.]cyou’).
- [T1218] Signed Binary Proxy Execution – The MSI runs a signed executable from a trusted vendor which is used to load the malicious DLL (‘the MSI file runs a signed executable from a trusted, well-known company’).
- [T1189] Drive-by Compromise – Initial distribution leverages downloads from cracked-software and torrent sites, redirecting users to Mega.nz ZIPs containing the malicious MSI (‘The attack begins on websites hosting cracked software and torrents… a Mega.nz link, which provides a ZIP file for download’).
Indicators of Compromise
- [Domains] exfiltration and C2/hosting – Gulbur[.]com, Hit-bone[.]com, and 5 more domains (L-back[.]com, Livedjudhr[.]cyou, Key-pack[.]com, Tcl-black[.]com, True-lie[.]com).
- [URLs] malware staging/control – hXXps://true-lie[.]com/api/machine/set-files-v (reported API endpoint used by the campaign).
- [File Hashes] malicious DLL avcodec-60.dll variants – CiviApp avcodec-60.dll: C92a0d040e76ec6a10a462f13bfc0c382da93e616fc8b981fb37ba89382e5019; RoxiApp avcodec-60.dll: 9e8838f69a052e985cd4affdc5510381eeaca72852bc968f0e1af2f708a8ab47 (and 1 more hash).
- [File Names / Binaries] installer and abused executables – MSI installers (RoxiApp, KcuzApp, CiviApp), UnRAR.exe, obs-ffmpeg-mux.exe, Nvidia GeForce Experience.exe (used as sideloading hosts).
https://www.hunters.security/en/blog/lummapp-infostealer-browser-extensions-credential-theft