a discord guild i was in got some malspam (link to reddit post which linked to malware present on compromised wordpress site sexccessories.co[.]ke)
Funnily enough, there were supposedly both windows and mac samples present, except they fucked up with the mac one, a passworded zip containing a “dmg” which is actually the following text:
Build failed: failed to create DMG: exit status 64
Output: Creating disk image...
Mounting disk image...
Device name: /dev/disk4
Searching for mounted interstitial disk image using /dev/disk4s...
Mount dir: /Volumes/dmg.kfA109
Copying background file '/tmp/8aAwS.png'...
Copying volume icon file '/Users/user/desktop/TradingView_3760.icns'...
Will sleep for 2 seconds to workaround occasions "Can't get disk (-1728)" issues...
Running AppleScript to make Finder stuff pretty: /usr/bin/osascript "/var/folders/1p/6ssndcmx4j7_gb_c2_0cdklm0000gn/T/createdmg.tmp.XXXXXXXXXX.dIQPQTlFZk" "dmg.kfA109"
/var/folders/1p/6ssndcmx4j7_gb_c2_0cdklm0000gn/T/createdmg.tmp.XXXXXXXXXX.dIQPQTlFZk:85:89: execution error: Finder got an error: Can’t get disk "dmg.kfA109". (-1728)
Failed running AppleScript
Unmounting disk image...
"disk4" ejected.
I predicted it would be a packed stealer of some description. I was right, unpacked binary is lumma stealer.
Been a while since I’ve done manual unpacking of a malware sample, this one was fun. The packer is the same as described here https://alertoverload.com/posts/2025/01/remcos-v5.3.0/
Original zipfile has the hash 85a2619c5bc5ae10d9ab3aab48c364b638d7b835d169f651b08c1f0282c39d58
.
The original binary was ~800MB, padded with garbage. Removing that padding yields a binary with the hash d0e956e5fe825e8f2817ce660d3680294d790cf1baec0bdfdc540841e7202c80
- and manually unpacking that gives bbd1e2cc95f1907d4c8c92d66bc62f43aa3e5634af6bdb947dfd826023195253
.
There’s also a bunch of additional stuff in the zip alongside the malware sample; copied straight from a windows installation, and the way it was copied in revealed the localisation installed on that system, which is unsurprisingly Russian (Russia) [ru-RU
].