Lumma Stealer infection with Sectop RAT (ArechClient2), (Fri, Apr 17th)

Key Points:

• Lumma Stealer malware infection was initiated through a password-protected 7-zip archive containing an inflated Windows executable, leading to subsequent deployment of Sectop RAT (ArechClient2).
• The impact includes potential credential theft and unauthorized access to infected systems, particularly targeting users who download cracked software.
• Recommended actions include blocking the identified C2 domains, implementing strict software download policies, and educating users about the risks of downloading pirated software.

Technical Details: The Lumma Stealer was delivered via a password-protected archive, which is a common tactic to evade detection. The malware's inflated size (806 MB) is achieved by padding with null bytes.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1203 - Exploitation for Client Execution (Initial Access)

IOCs Mentioned:

• hxxps://incolorand.com
• hxxps://mega-nz.goldeneagletransport.com
• hxxps://arch.primedatahost3.cfd

This summary provides actionable intelligence regarding the Lumma Stealer infection and its associated tactics, techniques, and procedures (TTPs). Security teams should prioritize mitigation efforts against these threats.