LAMEHUG: An LLM-Driven Malware for Dynamic Reconnaissance and Data Exfiltration
A new AI-driven threat named LAMEHUG employs Large Language Models (LLMs) on Hugging Face for adaptive reconnaissance and data exfiltration in real-time environments.
A new AI-driven threat named LAMEHUG employs Large Language Models (LLMs) on Hugging Face for adaptive reconnaissance and data exfiltration in real-time environments.
Unlike traditional malware, LAMEHUG generates Windows command-shell instructions dynamically using the Qwen 2.5-Coder-32B-Instruct model accessed via the Hugging Face API. This allows for real-time reconnaissance and targeted data collection, complicating detection and response efforts.
In July, CERT-UA disclosed the emergence of LAMEHUG, noting its use of LLMs within malware workflows. LAMEHUG is typically distributed through spear-phishing emails containing malicious executables disguised as AI image-generation tools. Common filenames include AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe.
Upon execution, the malware invokes the LLM_QUERY_EX() function, initiating its core malicious activities. A variant also drops a decoy PDF file to further deceive users. After launching the LLM thread, a large Base64 string is decoded to a dummy PDF, which is executed to mask the payload.
The LLM_QUERY_EX() routine is central to LAMEHUG's operation. It constructs prompts like "Enumerate system hardware details" and sends them to the Qwen 2.5-Coder-32B-Instruct model at router.huggingface.co.
The model returns custom Windows command sequences for gathering system and network data. Analysts from the Splunk Threat Research Team (STRT) have reconstructed several automated prompt-response cycles, revealing precise instructions for:
System Information Discovery (T1082): Using systeminfo and wmic for OS and hardware details. Automated File Collection (T1119): Using xcopy.exe to copy sensitive documents to C:\ProgramData\info.
This allows for real-time reconnaissance and targeted data collection, complicating detection and response efforts.
LAMEHUG adapts its reconnaissance based on real-time feedback, adjusting prompts accordingly. Data is then exfiltrated via SSH or HTTP channels.
To detect LAMEHUG, monitor for anomalies such as:
WMI Reconnaissance Detection : Track WMIC commands for suspicious enumeration. Net Service Enumeration : Detect net start usage for security-related processes. File Collection via Copy Utilities : Alert on xcopy.exe usage targeting document extensions. AI Platform DNS Queries : Monitor DNS requests to router.huggingface.co from common processes.
Combining vigilant anomaly detection with network and endpoint monitoring can disrupt LAMEHUG's operations.
SHA256 Hashes Description
384e8f3d300205546fb8c9b9224011b3b3cb71adc994180ff55e1e6416f65715 LAMEHUG
766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777 LAMEHUG
bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3 LAMEHUG
d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e LAMEHUG
Based on reporting by GBHackers.