Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1071552" data-attributes="member: 32260">WHHLight vs. Lumma Stealer(Smart App Control set to OFF)[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/beware-youtube-videos-promoting-cracked-software-distribute-lumma-stealer.128229/[/URL][URL unfurl=&quot;false&quot;]https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube[/URL][URL unfurl=&quot;false&quot;]https://app.any.run/tasks/d7724f7b-bbfe-4422-8c2a-77eeaf3cd6e3/#[/URL](the sample refused to run in the AnyRun sandbox)Attack flow:[ATTACH=full]280819[/ATTACH]The attack can be stopped at several stages:<ol>
<li data-xf-list-type="ol">SWH default settings block the LNK file (attack fully prevented at the early stage).</li>
<li data-xf-list-type="ol">The&nbsp; EXE payload (Installer-Install-2023_v0y.6.6.exe) would be blocked (in the Public folder) by WDAC with a default Whitelist - checked on the sample downloaded from AnyRun. The attack would be prevented before invoking the secondary payload.</li>
<li data-xf-list-type="ol">SWH default settings (PowerShell in Constrained Language Mode) would prevent downloading and invoking the secondary payload (DLL) by blocking PowerShell CmdLines: 
[System.Text.Encoding]::UTF8.GetString() 
[System.Reflection.Assembly]::Load() 
The attack would be fully mitigated and stopped before creating and injecting the final payload (Lumma Stealer).</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 1071552, member: 32260"] [B][SIZE=5]WHHLight vs. Lumma Stealer[/SIZE] [SIZE=4](Smart App Control set to OFF)[/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/beware-youtube-videos-promoting-cracked-software-distribute-lumma-stealer.128229/[/URL] [URL unfurl="false"]https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube[/URL] [URL unfurl="false"]https://app.any.run/tasks/d7724f7b-bbfe-4422-8c2a-77eeaf3cd6e3/#[/URL] (the sample refused to run in the AnyRun sandbox) [B][SIZE=5][COLOR=rgb(184, 49, 47)]Attack flow:[/COLOR][/SIZE][/B] [ATTACH type="full" alt="1704926046490.png"]280819[/ATTACH] The attack can be stopped at several stages: [LIST=1] [*]SWH default settings block the LNK file (attack fully prevented at the early stage). [*]The EXE payload (Installer-Install-2023_v0y.6.6.exe) would be blocked (in the Public folder) by WDAC with a default Whitelist - checked on the sample downloaded from AnyRun. The attack would be prevented before invoking the secondary payload. [*]SWH default settings (PowerShell in Constrained Language Mode) would prevent downloading and invoking the secondary payload (DLL) by blocking PowerShell CmdLines: [System.Text.Encoding]::UTF8.GetString() [System.Reflection.Assembly]::Load() The attack would be fully mitigated and stopped before creating and injecting the final payload (Lumma Stealer). [/LIST] [/QUOTE]

Verification