General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbWtiVFJWLXpfTUQyUExMLWJfR3Z1WGg0OWd6d3xBQ3Jtc0tubFJ3SE8yN1N5eElZSW8xNUoyakVfYnJ5U0lBcGNTdFBpdUlhMjhVdlJtTWEtVkx4WFUzRzVTUGU3Uy1HNXRQbDJMRldIRzVzZFotenJoRThBVTNNaTc1UWloUEkxNFZWM0tuRmJHamxKRnk2VXg2WQ&q=https%3A%2F%2Fsites.google.com%2Fview%2Fzensoft&v=PbmUZG7hHcA

  • Sample

    240421-tg9s9sfa6t

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://hearthingdirecwi.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Targets

    • Target

      https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbWtiVFJWLXpfTUQyUExMLWJfR3Z1WGg0OWd6d3xBQ3Jtc0tubFJ3SE8yN1N5eElZSW8xNUoyakVfYnJ5U0lBcGNTdFBpdUlhMjhVdlJtTWEtVkx4WFUzRzVTUGU3Uy1HNXRQbDJMRldIRzVzZFotenJoRThBVTNNaTc1UWloUEkxNFZWM0tuRmJHamxKRnk2VXg2WQ&q=https%3A%2F%2Fsites.google.com%2Fview%2Fzensoft&v=PbmUZG7hHcA

    Score
    10/10
    • Detect ZGRat V1

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks