General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbTZGR2Zncld0TmV1a0EteFdHZjBCU0dDZkM0UXxBQ3Jtc0tsUTljLWI3SmZyRmhuT01aaWQ1N0hfbk1fbTIydlA2VHJuYS1XNE1ZSkd6cUZwTm1fZ1dDTEM1U2lFRnhyOUJjbU5rUExJMUVXSWZ6U2lZVlpjNlR0TXpCd29Sc2NXRnNENTR1OE0zcVA2cTZiUXZxNA&q=https%3A%2F%2Fapp.mediafire.com%2Fv3txu5tkw7ln5&v=swg6voEZuZI

  • Sample

    250109-jm5fmawlfl

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://begguinnerz.biz/api

Targets

    • Target

      https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbTZGR2Zncld0TmV1a0EteFdHZjBCU0dDZkM0UXxBQ3Jtc0tsUTljLWI3SmZyRmhuT01aaWQ1N0hfbk1fbTIydlA2VHJuYS1XNE1ZSkd6cUZwTm1fZ1dDTEM1U2lFRnhyOUJjbU5rUExJMUVXSWZ6U2lZVlpjNlR0TXpCd29Sc2NXRnNENTR1OE0zcVA2cTZiUXZxNA&q=https%3A%2F%2Fapp.mediafire.com%2Fv3txu5tkw7ln5&v=swg6voEZuZI

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • A potential corporate email address has been identified in the URL: [email protected]

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks