SilverFox 1x + LummaStealer 1x

FD丶纸鸢

Setup.exe -> Lummastealer
msi -> SilverFox

这个lumma好像改变了加载方式，用到了autoit3
S1 miss
戎码翼龙Miss
卡巴UDS拉黑
银狐
卡巴KES双击触发PDM 衍生物HEUR杀 未触发高级清除
S1双击后杀衍生物 但衍生物任务管理器中仍然运行
重启后无感染迹象 开机提示缺少updat3.vac，判定为拦截成功




https://f.ws28.cn/f/fs5miwtx7mp 复制链接到浏览器打开

inhh1

Sophos:
Lumma Miss
银狐老样子 DynamicShellCode阻止+杀衍生

BD：
银狐阻止释放exe
Lumma ATD杀

swizzer

Lumma:

1. 2024/12/11 16:39
   
2. Harmful website https://covery-mover.biz blocked

复制代码

SilverFox:
missed. Anti-VM?

FD丶纸鸢

swizzer 发表于 2024-12-11 16:40
Lumma:

SilverFox:

No Anti-VM.
Tested by VMware
Edited:银狐据说反英文系统，英文系统无法执行

Fadouse

DI + S1 Kill All

lumma DI杀 下载恶意载荷的脚步执行
* S1 默认给的阈值太高了有点. 行为全检出了，动态AI就是不杀()

1. Behavioral Indicators
   
2. Evasion
   
3. AddAnyCertificate
   
4. A new certificate was added
   
5. MITRE: Defense Evasion {T1553.004}
   
6. AddCertificate
   
7. A new root certificate was added
   
8. MITRE: Defense Evasion {T1553.004}
   
9. HookRemovalAttemptAfterOverwrite
   
10. A function was overwritten
    
11. MITRE: Defense Evasion {T1562.001}
    
12. InstrumentationCallbackBypassAttempt
    
13. Hook bypass attempt via Instrumentation callback
    
14. MITRE: Defense Evasion {T1562.001}
    
15. MultipleHookRemovals
    
16. Multiple functions were unhooked
    
17. MITRE: Defense Evasion {T1562.001}
    
18. WmiQueryAntiVm
    
19. A WMI query was run as part of Anti-VM behavior
    
20. MITRE: Defense Evasion {T1622}
    
21. MITRE: {T1497}
    
22. MITRE: {T1497.001}
    
23. MITRE: {T1480.001}
    
24. MITRE: Discovery {T1622}
    
25. MITRE: {T1497}
    
26. MITRE: Execution {T1047}
    
27. MITRE: Collection {T1119}
    
28. InfoStealer
    
29. PossibleChromiumEdgeInfoStealing
    
30. Chromium Edge's sensitive information was accessed
    
31. MITRE: Credential Access {T1555.003}
    
32. MITRE: {T1552.001}
    
33. Malware
    
34. CoreDllRead
    
35. Detected attempt to read a core DLL of the OS
    
36. MITRE: Defense Evasion {T1562.001}
    
37. DirectSyscallAfterNtdllRead
    
38. Detected attempt to evade monitors with a direct syscall execution
    
39. MITRE: Defense Evasion {T1562.001}
    
40. HookRemovalAttemptAfterNtdllRead
    
41. A function was unhooked
    
42. MITRE: Defense Evasion {T1562.001}
    
43. ParallelNtDllLoad
    
44. Detected attempt to re-map a core DLL of the OS
    
45. MITRE: Defense Evasion {T1562.001}
    
46. N/A
    
47. DirectSyscall
    
48. Attempt to evade monitoring with a syscall directly
    
49. MITRE: Defense Evasion {T1562.001}
    
50. WmiQuerySystemInformationDiscovery
    
51. A WMI query was run to discover system information
    
52. MITRE: Discovery {T1082}
    
53. MITRE: Execution {T1047}
    
54. MITRE: Collection {T1119}
    
55. MITRE: {T1005}
    
56. MITRE: Defense Evasion {T1480.001}
    
57. WmiQuerySystemPrimaryUserDiscovery
    
58. A WMI query was run to discover the system primary user
    
59. MITRE: Discovery {T1033}
    
60. MITRE: Execution {T1047}
    
61. MITRE: Collection {T1119}
    
62. MITRE: Defense Evasion {T1480.001}
    
63. Reconnaissance
    
64. SuspiciousWMIQuery
    
65. Suspicious WMI query was identified
    
66. MITRE: Execution {T1047}
    
67. MITRE: Discovery {T1518.001}
    
68. MITRE: Collection {T1119}
    
69. MITRE: {T1005}
    
70. MITRE: Defense Evasion {T1480.001}

复制代码

silverfox DI杀 MSI.TMP

玛姆库特

毛豆老样子，入沙重启，无事发生，update.wnc又改成updat3.vac了


Setup.exe 双击入沙，错误自退

Eset小粉絲

https://wormhole.app/j9x5m#pGmQuQDxFfSaZIRdIdmEEw

Depumped Setup.exe

King、暮光

ESET提取新特征后这一轮还挺稳定 Win64/Agent.EXB 特洛伊木马 的变量
Setup.exe 右键miss，360沙箱里执行，ESET报BAT/Agent.QPG 特洛伊木马，exe消失
本体已上报

lsop1349987

虚拟机 Avira free 扫描miss双击寄
大蜘蛛 扫描misss双击
Lummastealer：防火墙报警
银狐：拦驱动
华为乾坤个人版 扫描miss双击miss 卡巴实机拦Lummastealer恶意地址

DisaPDB

lumma之前就用过AutoIt当做Loader，很常见的手法