216.73.217.22

LummaC2: Obfuscation Through Indirect Control Flow

· Published 27/09/2024 13:18 · Modified 27/09/2024 13:41

Export JSON

Essential information

Published
27/09/2024 13:18
Modified
27/09/2024 13:41
Tags
2024-09-27 lummac2
Related entities
6 techniques (mitre), 1 malware

Description

This analysis examines a control flow obfuscation technique used by recent stealer samples. The malware employs customized control flow indirection to manipulate execution, hindering reverse engineering and automated analysis. The obfuscation transforms functions into 'dispatcher blocks' that use encoded offsets and indirect jumps to obscure the original control flow. Three main dispatcher types are identified: register-based, memory-based, and mixed-order. The analysis also covers conditional dispatcher logic for loops and syscalls. To deobfuscate, the researchers developed an automated method using symbolic backward slicing to differentiate dispatcher instructions from original code and recover the true control flow. This allows rebuilding deobfuscated functions for analysis.

External references