I think the lack of actual building suite/street address in the email signature in the very first email would have immediately made me extremely suspicious. That's about as good as "Totally real business address, trust me bro, Singapore".
Also some kind of company main phone number in an email sig is a thing I'm expecting, even if it almost certainly goes to an IVR system, or the email sig doesn't have an extension number in it. But if a person is reaching out to me with a hand crafted email I'm also going to consider them a bit more suspiciously if there's no phone contact in the email sig.
Further, .xyz or similar as a company domain name is pretty damn suspicious when, for example, luaventures.net isn't taken as a domain name. 99% of the time when I see .xyz it's spam/scam/phishing disposable domains.
----------------
edit: looks like the website still exists: https://www.luaventures.xyz/ (open in sandbox, do not download anything, caution, etc!)
Googling luaventures.xyz turns up all sorts of weird things.
The C2 IP mentioned in the writeup appears to be a /24 of some small hosting company in the UAE.
reply