Full Report
A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers
Analysis Summary
# Tool/Technique: Fake LastPass Authenticator (Alinubx/Rapuncel)
## Overview
This campaign utilizes a fake LastPass Authenticator installer hosted on GitHub to deliver a multi-stage infection chain. The primary goal is to deploy a Microsoft-signed kernel driver to disable security software (BYOVD) and subsequently execute a password stealer to exfiltrate credentials, crypto wallets, and session tokens.
## Technical Details
- **Type:** Malware (Infostealer) / Technique (BYOVD)
- **Platform:** Windows
- **Capabilities:** Security software termination, DLL side-loading, privilege escalation, credential theft, browser injection.
- **First Seen:** August 2024 (Campaign reported September 2024)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise] (Via fake GitHub download pages)
- **[TA0005 - Defense Evasion]**
- [T1574.002 - DLL Side-Loading] (Abusing `vsdbg.exe` to load `vsdbg.dll`)
- [T1068 - Exploitation for Privilege Escalation] (Attaining SYSTEM via kernel driver)
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (Kernel-level termination of EDR/AV)
- [T1027 - Obfuscation] (File padding to bypass size-limited scanners)
- **[TA0006 - Credential Access]**
- [T1056.004 - Input Capture: GUI Input] (Injecting into Chrome/Edge for App-Bound encryption bypass)
- [T1555 - Credentials from Password Stores] (Browsers, Windows Credential Manager)
## Functionality
### Core Capabilities
- **DLL Side-Loading:** Uses a renamed version of the legitimate Microsoft tool `vsdbg.exe` to load a malicious `vsdbg.dll`.
- **BYOVD (Bring Your Own Vulnerable Driver):** Installs `Alinubx.sys` (a renamed version of `CcProtect.sys`), which is signed by Microsoft Windows Hardware Compatibility Publisher.
- **EDR/AV Killer:** The driver contains a hardcoded list of 145 security-related process names and terminates them from the kernel level to prevent detection.
- **Credential Harvesting:** Steals data from 20+ browsers, Discord, Steam, Telegram, and cryptocurrency wallets.
### Advanced Features
- **App-Bound Encryption Bypass:** Injects code into Chrome and Edge processes to programmatically request the browser's own service to decrypt stored passwords.
- **Stealth via Padding:** The installer archives are padded to ~150MB to evade automated sandbox analysis and antivirus scanners that ignore large files.
- **Rootkit Potential:** While not fully utilized in this campaign, the driver has latent capabilities to hide files and reroute network traffic.
## Indicators of Compromise
- **File Names:**
- `vsdbg.exe` (Renamed malicious loader)
- `vsdbg.dll` (Malicious DLL)
- `Alinubx.sys` (Maliciously repurposed driver)
- `CcProtect.sys` (Original driver name)
- **Network Indicators:**
- `github[.]com/LastPass-Authenticator` (Fake landing page)
- **Behavioral Indicators:**
- Creation of a new system service to load a kernel driver.
- Unexpected termination of security software processes (e.g., `MsMpEng.exe`, `Cortex.exe`).
- `vsdbg.exe` spawning unusual child processes or performing network activity.
## Associated Threat Actors
- Unknown (Campaign identified by LastPass and Delphos Labs).
## Detection Methods
- **Behavioral Detection:** Monitor for the installation of new kernel-mode services, especially those involving drivers listed in the [LOLDrivers](https://www.loldrivers.io/) project.
- **EDR Monitoring:** Alert on DLL side-loading events involving Microsoft debugging tools (`vsdbg.exe`) in user-writable directories (`\Downloads\`, `\AppData\`).
- **Signature-based:** Scan for the hash of `CcProtect.sys` (THUMBPRINT/SHA256) even if the filename is changed.
## Mitigation Strategies
- **Driver Blocklisting:** Enable and regularly update the **Microsoft Vulnerable Driver Blocklist**.
- **Application Control:** Implement AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unsigned or unauthorized binaries.
- **User Education:** Advise users to only download authenticators and security tools from official domains (e.g., `lastpass.com`) or official mobile app stores.
- **Restrict Privileges:** Enforce the principle of least privilege (PoLP) to prevent users from installing kernel-mode drivers.
## Related Tools/Techniques
- **CcProtect.sys / CnCrypt:** The original legitimate driver being abused.
- **LOLDrivers:** The repository documenting the vulnerable driver used in this attack.
- **Rapuncel Stealer:** The name associated with the infostealer component by researchers.