General
-
Target
https://github.com/grandroylgayelite9/YTtool/releases/download/1/gitsoft_v1.19.7z
-
Sample
240802-2h1kzstbnr
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/grandroylgayelite9/YTtool/releases/download/1/gitsoft_v1.19.7z
Resource
win10v2004-20240802-en
Malware Config
Extracted
lumma
https://toughsnxcmxz.shop/api
https://empiredzmwnx.shop/api
https://boattyownerwrv.shop/api
https://rainbowmynsjn.shop/api
https://definitonizmnx.shop/api
https://creepydxzoxmj.shop/api
https://budgetttysnzm.shop/api
https://chippyfroggsyhz.shop/api
https://assumedtribsosp.shop/api
Extracted
lumma
https://toughsnxcmxz.shop/api
https://empiredzmwnx.shop/api
https://boattyownerwrv.shop/api
https://rainbowmynsjn.shop/api
https://definitonizmnx.shop/api
https://creepydxzoxmj.shop/api
https://budgetttysnzm.shop/api
https://chippyfroggsyhz.shop/api
https://assumedtribsosp.shop/api
https://tenntysjuxmz.shop/api
Targets
-
-
Target
https://github.com/grandroylgayelite9/YTtool/releases/download/1/gitsoft_v1.19.7z
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-