LummaStealer 4x

zhuzhu009

https://wwzq.lanzouq.com/iflIv2j8ymbc


https://bazaar.abuse.ch/sample/6 ... 4684fcb97a64c9e5ea/
https://bazaar.abuse.ch/sample/2 ... afc5c60e502ffd61f4/
https://bazaar.abuse.ch/sample/a ... 77d589b35d8832ae6a/
https://bazaar.abuse.ch/sample/0 ... 46db7ff0088668a7ee/

多变的风向

FSP 3

Loyisa

BD扫描1x
gogolend1.zip=>ronwod.exe Trojan.GenericKD.75256683

BagsThroat.exe 网络拦截
media_update.zip/Package


media_update.zip/Package2


lumma.ps1
Heur.BZC.ZFV.Boxter.371.9241F1FF

UNknownOoo

火绒
扫描：3x

1. 扫描文件：20
   
2. 发现风险：3
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\4x-lummastealer\media_update\Package2\madbasic_.bpl, 病毒名：HEUR:Trojan/HiJack.z, 病毒ID：95aae3285b8af0ca, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\4x-lummastealer\BagsThroat.exe >> [NSIS].nsi, 病毒名：Trojan/Runner.bz, 病毒ID：a0c19ec75086f415, 处理结果：暂不处理
   
7. 风险路径：C:\Users\UnknownOoo\Downloads\4x-lummastealer\lumma.ps1, 病毒名：TrojanDownloader/PS.NetLoader.hp, 病毒ID：b93c9d3487832e9d, 处理结果：暂不处理
   

复制代码

X-Sec
扫描：3x

1. ---------------------
   
2. 2024/12/28 17:41:54 Threat Detected: C:\Users\UnknownOoo\Downloads\4x-lummastealer\BagsThroat.exe -- [rame-cloud] Trojan.Runner!8.93
   
3. 2024/12/28 17:41:55 Threat Detected: C:\Users\UnknownOoo\Downloads\4x-lummastealer\gogolend1\ronwod.exe -- [rame-cloud] Trojan.Kryptik!8.8
   
4. 2024/12/28 17:41:59 Threat Detected: C:\Users\UnknownOoo\Downloads\4x-lummastealer\media_update\Package2\madbasic_.bpl -- [rame-cloud] Trojan.HiJack!8.1159F

复制代码

Fadouse

静态 DI 3x + KES 1x

1. Event: Malicious object detected
   
2. User: WORKGROUP\LAPTOP$
   
3. User type: Initiator
   
4. Application name: SentinelAgent.exe
   
5. Application path: C:\Program Files\SentinelOne\Sentinel Agent 24.2.1.408
   
6. Component: File Threat Protection
   
7. Result description: Detected
   
8. Type: Trojan
   
9. Name: HEUR:Backdoor.Win32.Agent.gen
   
10. Precision: Heuristic analysis
    
11. Threat level: High
    
12. Object type: File
    
13. Object name: BagsThroat.exe
    
14. Object path: E:\Code\Virus\4x-lummastealer
    
15. SHA256 of an object: 0158AA426FCEB64ED638B0ABDDBB6E26DC0806938AD34246DB7FF0088668A7EE
    
16. MD5 of an object: 3B819D687B2BDE89ADE8EB1AEB4C6C5F
    
17. Reason: Machine learning
    
18. Databases release date: Today, 12/28/2024 3:48:00 PM

复制代码

桔梗想见雪

Fadouse 发表于 2024-12-28 17:42
静态 DI 3x + KES 1x

eset解压杀1个，双击hmpa杀1个，还有一个双击自退

驭龙

趋势安全无忧，双击无拦截

jijianan2007

迈克菲 2X

Loyisa

驭龙 发表于 2024-12-28 17:52
趋势安全无忧，双击无拦截

确实很无忧

驭龙

Loyisa 发表于 2024-12-28 17:54
确实很无忧

是真的无忧啊，中毒都不知道的无忧，玩不下去了，卸载