Overview

overview

10

Static

static

Lunar_Builder.exe

windows7_x64

Lunar_Builder.exe

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Lunar_Builder.exe

  • Size

    9.0MB

  • Sample

    211021-23y8naahd6

  • MD5

    8447872f84b93f6ecd569d02ad015946

  • SHA1

    83dc66227dc96b05a6698c646f40c2feede9bbe7

  • SHA256

    a3f52ba48f30b2cd149356abba4bd722f216a992d8665290a5d4fe1e9391a7cd

  • SHA512

    498fe9e92e2a25c99ab00bfb1452405697e67eb4918c06a906829e9047952ae9ad1be69aa28d4553ce6e8b6f1c1d7152c0589090260754fb84e1301bdc0971a4

Score
10/10
evasionspywarestealertrojanupx

Malware Config

Targets

    • Target

      Lunar_Builder.exe

    • Size

      9.0MB

    • MD5

      8447872f84b93f6ecd569d02ad015946

    • SHA1

      83dc66227dc96b05a6698c646f40c2feede9bbe7

    • SHA256

      a3f52ba48f30b2cd149356abba4bd722f216a992d8665290a5d4fe1e9391a7cd

    • SHA512

      498fe9e92e2a25c99ab00bfb1452405697e67eb4918c06a906829e9047952ae9ad1be69aa28d4553ce6e8b6f1c1d7152c0589090260754fb84e1301bdc0971a4

    Score
    10/10
    evasionspywarestealertrojanupx

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2
T1031

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks