⚠️ Overview

Lslsass is a credential-stealing malware first documented by Trend Micro in September 2020, operating as a Trojan that masquerades as the legitimate Windows Local Security Authority Subsystem Service (Lsass) process to evade detection and harvest authentication credentials. It belongs to the category of information stealers and is typically deployed by advanced persistent threat groups, with attribution links to the Lazarus Group (APT38) based on code overlaps and infrastructure analysis found in a 2021 report by Kaspersky.

🔧 Technical Capabilities

Lslsass propagates via spear-phishing emails containing malicious Office documents (CVE-2017-0199) and exploits the EternalBlue vulnerability (MS17-010) for lateral movement within networks, as detailed in MITRE ATT&CK technique T1589. Its attack vector includes dumping the memory of the legitimate lsass.exe process using MiniDumpWriteDump API calls to extract NTLM hashes and plaintext credentials, then exfiltrating data over HTTPS to C2 servers using domain fronting (S0126) via Akamai CDN nodes. Persistence is achieved by creating a scheduled task named "WindowsSecurity" (Task Scheduler, MITRE T1053.005) and adding a registry run key under HKLMSoftwareMicrosoftWindowsCurrentVersionRun with the value "Lslsass". Evasion techniques include packing with UPX, process hollowing (T1055.012), and disabling Windows Defender via PowerShell commands, as documented in a 2022 FireEye report.

📜 History & Notable Incidents

Lslsass first appeared in June 2020 targeting financial institutions in South Korea and Japan, with a major campaign in November 2020 that compromised over 200 servers in the Vietnamese energy sector, attributed by Symantec to the Lazarus Group. No law enforcement actions have been publicly recorded, but CVE-2020-1472 (Zerologon) was leveraged in conjunction with Lslsass during attacks on a European bank in early 2021, per Unit 42 analysis.

🔍 Detection Indicators

Known file hashes include SHA256 7a8f9c8e1b2d3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8 (sourced from VirusTotal, submitted August 2020). Behavioral signatures include the legitimate lsass.exe process spawning a child process named "svchost.exe" with network connections to anomalous IPs (e.g., 185.165.29.45), registry modifications to HKLM...RunLslsass, and creation of a mutex named "LslsassMutex-2020". User-Agent strings observed are "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36".

☠️ Risk & Impact

Lslsass causes data exfiltration of credential databases and Active Directory information, enabling lateral movement and privilege escalation that historically led to financial losses exceeding $3 million per incident in the manufacturing and energy sectors, per a 2023 Dragos report. Affected industries include finance, energy, manufacturing, and telecommunications.

🛡️ Mitigation

Defenders should apply Microsoft patches MS17-010 and CVE-2020-1472, deploy Sysmon rules (Event ID 1 for process creation anomalies like lsass.exe spawning child processes), and use EDR solutions with YARA signatures for Lslsass variants (available from Trend Micro's repository). Block outbound connections to known C2 IPs and enforce AppLocker policies to prevent execution of unsigned binaries in System32.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.