FortiGuard Labs recently discovered a threat group using YouTube channels to distribute a Lumma Stealer variant.
These YouTube videos typically feature content related to cracked applications, presenting users with similar installation guides and incorporating malicious URLs often shortened using services like TinyURL and Cuttly.
NET loader responsible for fetching the final malware, Lumma Stealer.
Lumma Stealer targets sensitive information, including user credentials, system details, browser data, and extensions.
Figure 1 shows Lumma Stealer's C2 server telemetry, illustrating a global presence with a peak observed in December.
Figure 3 shows the video descriptions in which a malicious URL is embedded, enticing users to download a ZIP file that harbors malicious content for the next stage of the attack.
The videos were uploaded earlier this year, but the files on the file-sharing site receive regular updates, and the number of downloads keeps growing.
Figure 9 illustrates a portion of the code and the newly generated process.
Figure 10 shows the partial PowerShell code from the private.
The script encodes the server IP address in Base64 and encompasses four servers.
Figure 11 shows captured traffic downloaded from the first server, 176[.]113[.
After receiving the data, the script decrypts it using AES CBC, followed by GZip decompression to obtain the DLL file for the next stage.
It employs several PNG files in the Resources section to decipher the ultimate payload of Lumma Stealer.
Figure 14 demonstrates the function of decoding the target text with a predefined key string.
It then attempts to locate wine get unix file name to determine if Wine is being used in an analysis environment.
Lumma stealer is a type of malware that can steal sensitive information from a user's computer.
The malware establishes communication with a command and control server, facilitating the exchange of instructions and transmitting pilfered data.
Figure 16 shows the method to contact a command and control server.
In this attack, the malicious actor targets YouTube channels to disseminate Lumma Stealer.
The crafted installation ZIP file serves as an effective bait to deliver the payload, exploiting the user's intention to install the application and prompting them to click the installation file without hesitation.
This Cyber News was published on feeds.fortinet.com. Publication date: Mon, 08 Jan 2024 16:43:05 +0000