General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa256OHg2NGg2bGtSMjhsbDJFbVotUEthNVFXZ3xBQ3Jtc0tuRDQ2N09FRklQVmFLOUdmLTJzZFdwWGtYanB5R2hhSHZFbGNWcUtJYmVzTVJ2MFdyMHNuRUdJNnVaTHJ1NDBXRGx0NERtMURPdndEMlp1eXJUWnA2NUlkV3cyeU1OMG94M3daalM1SXV4THZFVlNJRQ&q=https%3A%2F%2Finsomniahack.fun%2F&v=q8hCilHiysM

  • Sample

    240524-blxqdsga82

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

https://roomabolishsnifftwk.shop/api

Targets

    • Target

      https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa256OHg2NGg2bGtSMjhsbDJFbVotUEthNVFXZ3xBQ3Jtc0tuRDQ2N09FRklQVmFLOUdmLTJzZFdwWGtYanB5R2hhSHZFbGNWcUtJYmVzTVJ2MFdyMHNuRUdJNnVaTHJ1NDBXRGx0NERtMURPdndEMlp1eXJUWnA2NUlkV3cyeU1OMG94M3daalM1SXV4THZFVlNJRQ&q=https%3A%2F%2Finsomniahack.fun%2F&v=q8hCilHiysM

    Score
    10/10
    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks