General
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1230856531810193408/1232808107566956574/OnlyFanLeaked_18.zip?ex=662acd85&is=66297c05&hm=26b52ce728716f1320804a51ed9aa19bea94f1b53eb5633ce0620db99ed5e31e&1
Resource
win10v2004-20240412-en
Malware Config
Extracted
lumma
https://handbreeadretwaiw.shop/api
https://productivelookewr.shop/api
https://tolerateilusidjukl.shop/api
https://shatterbreathepsw.shop/api
https://shortsvelventysjo.shop/api
https://incredibleextedwj.shop/api
https://alcojoldwograpciw.shop/api
https://liabilitynighstjsko.shop/api
https://demonstationfukewko.shop/api
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1230856531810193408/1232808107566956574/OnlyFanLeaked_18.zip?ex=662acd85&is=66297c05&hm=26b52ce728716f1320804a51ed9aa19bea94f1b53eb5633ce0620db99ed5e31e&1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-