Lumma Stealer infection with Sectop RAT (ArechClient2), (Fri, Apr 17th)
Source SANS ISC Handlers Diary
Description
Introduction
Impact
The infection enables data theft via Lumma Stealer and persistent remote access through Sectop RAT, potentially allowing attackers to maintain control over compromised Windows systems. The use of password-protected archives and inflated executables padded with null bytes complicates detection by security tools. The RAT's encrypted communications hinder network-based detection. The threat can lead to unauthorized data exfiltration and system compromise. However, no evidence of widespread exploitation or active campaigns beyond the described infection vector is provided.
Defensive guidance
Since the infection vector relies on downloading and executing malware from cracked software sites, the primary mitigation is to avoid using unauthorized or cracked software and to educate users about the risks of such downloads. Security teams should use updated endpoint detection tools capable of identifying large padded executables and monitor for known indicators of compromise such as the provided hashes and C2 domains. Network defenses should consider blocking communications to the identified C2 domains and IP addresses.
Summary
The threat involves a multi-stage infection starting with Lumma Stealer delivered through a password-protected 7-zip archive containing an inflated Windows executable padded with null bytes to avoid detection. The initial infection is distributed via websites advertising cracked software, using URLs that impersonate legitimate download sites. Upon execution, Lumma Stealer establishes communication with several command and control domains. Following this, a 64-bit DLL implementing Sectop RAT (ArechClient2) is downloaded and executed via rundll32, providing persistent remote access on the infected Windows host. Network traffic from the RAT is encrypted or encoded and communicates over non-standard ports. Indicators of compromise include specific SHA256 hashes for the malware components and known C2 domains.