Resubmissions

02/10/2024, 15:47

241002-s8mblsvank 10

02/10/2024, 15:44

241002-s6wr9sxgrb 3

General

  • Target

    https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbG5kbGRTUHAwWnE2Nk00YnAzcFduUmlqcDJ3d3xBQ3Jtc0tuT3gxZUJ5YmJIbkJ0TEp3a2V1d19lYkdsWUp2UzdqOUlncmdUZzNNd2d5Yk9ZOVpiSFlqb21lcTlMZmVRMWdlbll3RWFabGNfS051cGktVHZNTkhuZUtYaUcxS1BTYVdOQ3NlZUY4Xy1jNFJrSlE2WQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fpdvnpt1sbe0w4%2FSoftware

  • Sample

    241002-s8mblsvank

Malware Config

Extracted

Family

lumma

Extracted

Family

lumma

C2

https://gravvitywio.store/api

Targets

    • Target

      https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbG5kbGRTUHAwWnE2Nk00YnAzcFduUmlqcDJ3d3xBQ3Jtc0tuT3gxZUJ5YmJIbkJ0TEp3a2V1d19lYkdsWUp2UzdqOUlncmdUZzNNd2d5Yk9ZOVpiSFlqb21lcTlMZmVRMWdlbll3RWFabGNfS051cGktVHZNTkhuZUtYaUcxS1BTYVdOQ3NlZUY4Xy1jNFJrSlE2WQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fpdvnpt1sbe0w4%2FSoftware

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks