Скачать или смотреть SA - SOC338-316 - Lumma Stealer - DLL Side-Loading via Click Fix Phishing

Continuing with the Security Analyst Path, we tackle an CRITICAL alert for an "Lumma Stealer - DLL Side-Loading via Click Fix Phishing". Was this a Click Fix scenario, phishing, simply a false positive or possibly something more malicious?

EventID: 316
Event Time: Mar, 13, 2025, 09:44 AM
Rule: SOC338 - Lumma Stealer - DLL Side-Loading via Click Fix Phishing
Level: Security Analyst
SMTP Address: 132.232.40.201
Source Address: [email protected]
Destination Address: [email protected]
E-mail Subject: Upgrade your system to Windows 11 Pro for FREE
Device Action: Allowed


Items in question:
https://talosintelligence.com/reputat...
https://otx.alienvault.com/indicator/...
https://otx.alienvault.com/pulse/67d0...
https://www.virustotal.com/gui/domain...

https://talosintelligence.com/reputat...
https://otx.alienvault.com/indicator/...
https://www.virustotal.com/gui/url/41...


NOTES:
https://www.proofpoint.com/us/blog/th...
https://www.group-ib.com/blog/clickfi...
https://www.kaspersky.com/blog/what-i...