Overview

overview

10

Static

static

usfive_202...44.exe

windows7_x64

10

usfive_202...44.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    usfive_20210804-112044

  • Size

    3KB

  • Sample

    210804-37mqqeqe3x

  • MD5

    172da997f8be4c8d0318a322c8ee806e

  • SHA1

    224d3e925800815e792af3a28f8d2dffb9c21e70

  • SHA256

    db246897a0efe3c4b3cd4b9f832067815fa920045e9a5a3d0881dc9ffd958fb0

  • SHA512

    75e85d44f076dee7505389284609ab4b138d676d777e3ebfe37e11053b293b7f5d91cfb66a4304539fb41c91db74c79ec93d262cbe1e908ffd5f530be4475ca4

Score
10/10
lu0botdiscoverystealersuricatatrojan

Malware Config

Targets

    • Target

      usfive_20210804-112044

    • Size

      3KB

    • MD5

      172da997f8be4c8d0318a322c8ee806e

    • SHA1

      224d3e925800815e792af3a28f8d2dffb9c21e70

    • SHA256

      db246897a0efe3c4b3cd4b9f832067815fa920045e9a5a3d0881dc9ffd958fb0

    • SHA512

      75e85d44f076dee7505389284609ab4b138d676d777e3ebfe37e11053b293b7f5d91cfb66a4304539fb41c91db74c79ec93d262cbe1e908ffd5f530be4475ca4

    Score
    10/10
    lu0botdiscoverystealersuricatatrojan

    • Lu0bot

      Lu0bot is a lightweight infostealer written in NodeJS.

      trojanstealerlu0bot

    • suricata: ET MALWARE lu0bot Loader HTTP Request

      suricata

    • suricata: ET MALWARE lu0bot Loader HTTP Response

      suricata

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks