lu0bot

Resubmissions

02-09-2021 19:12

210902-xwla1aeefq 10

02-09-2021 19:09

210902-xtsbjabea9 8

Sharing

Copy URL

Twitter E-mail

General

Target

Anime-Fighters-Infin_734316524.zip
Size

9.7MB
Sample

210902-xwla1aeefq
MD5

2206849ca275c100c18d6feade905ad3
SHA1

61d1a76826305738845c286d5c7078337d8b2d35
SHA256

c91c6c4c1162115c8d7f82f2d9f4098ee61fbe9051d3350b0a2f97fa2ce3e6f2
SHA512

69784817974e5fadf7cf19455fdb164ce90aeb2a1d86164ecaf226316b118ca187d01188cf4d06f7736358198a6e12c247bf8a5e5b0e60693d9295996a33578c

Score

10^/10

Malware Config

Targets

- Target
  
  Anime-Fighters-Infin_734316524.exe
- Size
  
  3.9MB
- MD5
  
  bd2b73492acf20dec004360b1605032d
- SHA1
  
  60ddf3c107d94bbeb102a2d7ede945eb5edd2b35
- SHA256
  
  12b6272825140a15eabec58f97b49aed3ce5db7816a0b3c2674f6ae8746367ca
- SHA512
  
  dae236259e32a9e4b789f020dbd8082b376e3c2b56fd94523a44cf4b5a557f3661aeefc24b5605218ba0479ee1b9a8cb7b5c1df6c103673a99f13bc4210c90da
Score

10^/10

discovery lu0bot persistence stealer suricata trojan upx
- Lu0bot
  Lu0bot is a lightweight infostealer written in NodeJS.
  trojan stealer lu0bot
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- suricata: ET MALWARE lu0bot Loader HTTP Request
  suricata: ET MALWARE lu0bot Loader HTTP Request
  suricata
- suricata: ET MALWARE lu0bot Loader HTTP Response
  suricata: ET MALWARE lu0bot Loader HTTP Response
  suricata
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9 behavioral10

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Modifies system executable filetype association

Registers COM server for autorun

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE lu0bot Loader HTTP Request

suricata: ET MALWARE lu0bot Loader HTTP Response

ACProtect 1.3x - 1.4x DLL software

Blocklisted process makes network request

Downloads MZ/PE file

Drops file in Drivers directory

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Modifies file permissions

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10