General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Language
hta
Source
URLs
hta.dropper
https://github.com/git62025/movie/releases/download/movie2/blueredgreen.mp4
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://klipdohesoo.shop/ruwin.png
Extracted
Language
hta
Source
URLs
hta.dropper
https://github.com/git62025/movie/releases/download/movie2/blueredgreen.mp4/1
Extracted
Family
lumma
C2
https://rainywearyrs.cyou/api
Targets
-
-
Target
https://github.com/git62025/movie/releases/download/movie2/blueredgreen.mp4
-
Lumma family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-