Extracted

• • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHNKZWxBOExZQ0xxc0hXU3JzMmc2a1NrVXpBUXxBQ3Jtc0trZmhaNU4xa3ljc1d5WFpNMTF1T2RQSnlJVTZlOXpBSl91N3lRTTI1NTBGNVExbDQxb0RQdkFBcnV2WnVSY09HSHk1SU1qRGU4bEZ1dGRmbzFMQXdiWGpiS0Ewek9oVUZLUnVvaHpCamdlaEQ2b3pOaw&q=https%3A%2F%2Fsites.google.com%2Fview%2Fnexol&v=6mF7AbF_SiE

  Score

  10^/10

  lummamicrosoftdefense_evasiondiscoveryevasionphishingproduct:outlookstealerthemida

  • Detected microsoft outlook phishing page

    phishingmicrosoftproduct:outlook

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Legitimate hosting services abused for malware hosting/C2

  • System Binary Proxy Execution: Verclsid

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion

  • Detected potential entity reuse from brand MICROSOFT.

    phishingmicrosoft

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1