Grant

[Grant @_gwsales]

@vxunderground It’s normal.

My first was the same.

[vx-underground @vxunderground]

> be me
> get DM
> "smelly i found goop"
> wtf i love goop (malware)
> "It's Linux malware. The malware was" blah blah blah
> long lore story about something
> something about anime or something
> idk wtf theyre talking about
> idc
> just want goop
> download file
> look inside
> big ass fuck off obfuscated bash script
> aes-256 encrypted stuff
> some hex encoded stuff
> hex encoded string
> /.config/.pipeaudio/.env
> tries to copy itself there
> more hex encoding
> ~/.config/systemd/user/flawless.service
> sets description for service
> something about apple music
> neat
> uses JSON rpc stuff
> omfg its this smart contract bs again
> json rpc to proxy.lmfaoxd(.)lol
> abi encoded strings
> aes-256 encrypted thingie
> aes-256 decryption key for aes-256 stuff in bash
> password: "bb344490dd24c88cb9389839bf0709d72a7beeec149bd790914d77ac0033f96f"
> aes-256 decode
> fails
> realize URL is base64 encoded twice
> wtf
> decode
> decrypt again
> bucket.lmfaoxd(.)lol
> bash script appends to this decrypted url
> /amd64, /arm64, /386
> neat
> downloads from directory based on pcs cpu
> neat
> download
> decrypt
> 41mb file
> damn wtf das a big file
> look inside
> written in Go
> metadata stripped
> wtf bro
> strings give off a smell, a smelly smell
> a smelly smell that smells like SliverC2
> heavily obfuscated using Garble
> ye its SliverC2

C2:
lmfaoxd(.)lol
bucket.lmfaoxd(.)lol
proxy.lmfaoxd(.)lol

Smart Contract:
0x0000000000d2dCC83D913bd90653b2ef69340f87

Loader:
ed11f431ce9bda16dd98558ec996c53a80841083c0c00deef215c2b0889d1b34

Sliver Payload (decrypted):
2c01c232d9d054efd6949695c3c7aeddbeb68fa3a848b7632cd634eb7b59de4d

Sliver payload (encrypted):
2f8e4c5baa78f4d68cc9ac06d4bd33b4420d2d35b8168d195069a0b32c602702

Overall this was some pretty cool goop. I rarely find Linux malware that isn't some IoT bullshit. Based off of the C2 domain I am going to assume this is a smaller malware campaign, but just because it's smaller doesn't mean it's not neato goop.

Pic unrelated

[Who said what? @g0njxa]

First thoughts about #Lumma Stealer "disruption" (?):

There's no need in calling big names on something that (from what I've read and tested) has not happened in the magnitude I'm watching on the media

At the moment, Lumma still works, still has working C2s and *apparently* no final major impact has been done to their malware operations despite the big media impact going on. Is true that I saw some malware operations chats in the past hours/days claiming to have issues with the stealer and this is being resolved in a matter of hours like normal issues that previously happened.
Here's is proof of a non-crypted build working on a fresh non-seized domain (see photo 1)
Detonation: https://t.co/1fZcBAbGwC

And more proof on log registers from threat actors using Lumma (meaning the infostealer still is infecting machines) (see photo 2)

The efforts in this partial "disruption" operation seems to be focused on the seizure of already known C2 servers (gathered by malware intelligence services), being this domains active in use or not. That's why there's already new domains working, or previous domains that went unnoticed, and this not means the Lumma Stealer infrastructure has been disrupted!

Would this events start a "war of attrition" where newly found C2 domains will be quickly seized? We will see, and I don't think is a good idea.

This is a questionable approach to Lumma due to the nature of this infostealer, whose C2 servers (that act as a proxy to deliver log from victim computer to a panel) are changed and rotated in a daily basis.

And talking about the panels (something that could be more interesting to takedown), seems like the disruption and seizure of the already known panels has been committed partially (see photo 3) and of course this represents the seizure of a domain involved in a malware campaign by a customer, not the whole administration of Lumma Stealer.

As said before, efforts to disrupt malware operations are always appreciated and I want to imagine the big work on behalf the operations, but I think events like today ones and claiming things that I don't believe they are true news just harm the reputation of the big companies and LE agencies that everyday tries to keep the world safer.
Less drawings, more actions.

As said before, I'm commenting the situation after the initial reports.
I'll wait for further movements and statements, keeping a close eye. I can't know what is going to happen in the next days.

[Nick Carr @ItsReallyNick]

LummaC2 / Lumma Stealer takedown 👊: "Microsoft identified over 394,000 Windows computers globally infected by the Luma malware. Working with law enforcement and industry partners, we have severed communications between the malicious tool and victims. Moreover, more than 1,300 domains seized by or transferred to Microsoft, including 300 domains actioned by law enforcement with the support of Europol, will be redirected to Microsoft sinkholes...

Disrupting the tools cybercriminals frequently use can create a significant and lasting impact on cybercrime, as rebuilding malicious infrastructure and sourcing new exploit tools takes time and costs money. By severing access to mechanisms cybercriminals use, such as Lumma, we can significantly disrupt the operations of countless malicious actors through a single action." 🧹