Lummac2 Stealer

LummaC2 Stealer is a type of malware that has gained significant attention due to its capacity to steal sensitive information, including digital wallets and user credentials. It can even target two-factor authentication (2FA) browser extensions, making it particularly threatening. Over the past year, this malicious software has been found in new malware such as SVCReady, CargoBay, Matanbuchus, Pikabot, Aresloader, Vidar, Minodo, and others. The ESET Threat Report highlighted a 68% surge in detections of malware designed to steal cryptocurrency from users' wallets, known as cryptostealers, from H1 to H2 2023, with LummaC2 Stealer being one of the most prevalent. The malware has been linked to certain files that lead to infection. Notably, the "phoneoutsourcing.exe" file is associated with the RisePro stealer, while the "647887023.png" file leads to infection with LummaC2 Stealer. In one instance, a program called FakeBat was found to drop LummaC2 Stealer into systems. Once installed, the malware operates covertly, often without the user's knowledge. A decrypted payload identified as LummaC2 Stealer was discovered with the user ID: 9zXsP2. Recent updates to LummaC2 Stealer have further increased its threat level by incorporating a novel trigonometry-based anti-sandbox technique. This technique enables the malware to lay dormant until it detects "human" behavior in the infected machine, thereby evading automated detection methods. This sophisticated approach demonstrates the evolving capabilities of malware creators and underscores the need for robust cybersecurity measures to protect against these threats.