General
-
Target
https://download2291.mediafire.com/ewqovavxjbrgHa1S3kf0QCs6En-4zgPbmEYvVe6945IQ2EwRcqSPumJKUxncaR5uMiiIV58JedBMXngN01T3vtAAgyu9WQA8E4HAhqC4fJ_KGdUGr_r48X9IPfwitXmazY-OKOQlVFzIJ887lTwuA_Q0X-5Zib0a1YjmulY57P8SMGQ/wtolwi0lab4l6pf/Aura.zip
-
Sample
250109-gphnjatkbp
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://download2291.mediafire.com/ewqovavxjbrgHa1S3kf0QCs6En-4zgPbmEYvVe6945IQ2EwRcqSPumJKUxncaR5uMiiIV58JedBMXngN01T3vtAAgyu9WQA8E4HAhqC4fJ_KGdUGr_r48X9IPfwitXmazY-OKOQlVFzIJ887lTwuA_Q0X-5Zib0a1YjmulY57P8SMGQ/wtolwi0lab4l6pf/Aura.zip
Resource
win10v2004-20241007-en
Malware Config
Extracted
lumma
https://robinsharez.shop/api
https://handscreamny.shop/api
https://chipdonkeruz.shop/api
https://versersleep.shop/api
https://crowdwarek.shop/api
https://apporholis.shop/api
https://femalsabler.shop/api
https://soundtappysk.shop/api
https://letterdrive.shop/api
Targets
-
-
Target
https://download2291.mediafire.com/ewqovavxjbrgHa1S3kf0QCs6En-4zgPbmEYvVe6945IQ2EwRcqSPumJKUxncaR5uMiiIV58JedBMXngN01T3vtAAgyu9WQA8E4HAhqC4fJ_KGdUGr_r48X9IPfwitXmazY-OKOQlVFzIJ887lTwuA_Q0X-5Zib0a1YjmulY57P8SMGQ/wtolwi0lab4l6pf/Aura.zip
-
Lumma family
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
A potential corporate email address has been identified in the URL: [email protected]
-
Suspicious use of SetThreadContext
-