Resubmissions

29/02/2024, 07:05 UTC

240229-hwjd3shg3t 10

29/02/2024, 06:58 UTC

240229-hrjt2shf31 1

General

  • Target

    https://www.mediafire.com/file/g0d6df68cz7migc/Roblox_cheat.zip/file

  • Sample

    240229-hwjd3shg3t

Malware Config

Extracted

Family

redline

C2

45.15.156.142:33597

Extracted

Family

lumma

C2

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Targets

    • Target

      https://www.mediafire.com/file/g0d6df68cz7migc/Roblox_cheat.zip/file

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.