General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa256OHg2NGg2bGtSMjhsbDJFbVotUEthNVFXZ3xBQ3Jtc0tuRDQ2N09FRklQVmFLOUdmLTJzZFdwWGtYanB5R2hhSHZFbGNWcUtJYmVzTVJ2MFdyMHNuRUdJNnVaTHJ1NDBXRGx0NERtMURPdndEMlp1eXJUWnA2NUlkV3cyeU1OMG94M3daalM1SXV4THZFVlNJRQ&q=https%3A%2F%2Finsomniahack.fun%2F&v=q8hCilHiysM
-
Sample
240524-blxqdsga82
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa256OHg2NGg2bGtSMjhsbDJFbVotUEthNVFXZ3xBQ3Jtc0tuRDQ2N09FRklQVmFLOUdmLTJzZFdwWGtYanB5R2hhSHZFbGNWcUtJYmVzTVJ2MFdyMHNuRUdJNnVaTHJ1NDBXRGx0NERtMURPdndEMlp1eXJUWnA2NUlkV3cyeU1OMG94M3daalM1SXV4THZFVlNJRQ&q=https%3A%2F%2Finsomniahack.fun%2F&v=q8hCilHiysM
Resource
win10v2004-20240508-en
Malware Config
Extracted
lumma
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa256OHg2NGg2bGtSMjhsbDJFbVotUEthNVFXZ3xBQ3Jtc0tuRDQ2N09FRklQVmFLOUdmLTJzZFdwWGtYanB5R2hhSHZFbGNWcUtJYmVzTVJ2MFdyMHNuRUdJNnVaTHJ1NDBXRGx0NERtMURPdndEMlp1eXJUWnA2NUlkV3cyeU1OMG94M3daalM1SXV4THZFVlNJRQ&q=https%3A%2F%2Finsomniahack.fun%2F&v=q8hCilHiysM
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-