Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Anatomy of a Lumma Stealer Attack via Fake CAPTCHA Pages - Part 1
Malware Families
Excerpt
As of late August 2024, attackers have been using fraudulent "human verification" pages to trick users into executing a malicious PowerShell script. This blog post will explore the full attack vector, detailing how the malware is delivered, executed, and the indicators of compromise (IOCs) involved. Lumma Stealer is designed to exfiltrate sensitive information such as passwords, session tokens, cryptocurrency wallets, and other personal data from infected machines.…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 07b127b0c351547fa8ec4cac6cd5fd68dc8916dc4557ab13909ca95d53478a7d | High | Score 58/100 | First seen |
| Domain | greetycruthsuo.shop | High | Score 58/100 | First seen |
| Domain | futureddospzmvq.shop | High | Score 64/100 | First seen |
| SHA256 | 539574e6af31c459925943267001e2a9d61fb2c592762b5c4dcbedd90155d8a3 | High | Score 58/100 | First seen |
| SHA256 | 7d6ee310f1cd4512d140c94a95f0db4e76a7171c6a65f5c483e7f8a08f7efe78 | High | Score 58/100 | First seen |
| Domain | tibedowqmwo.shop | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…