Overview

overview

10

Static

static

9f7ae2627e...f3.exe

windows7-x64

10

9f7ae2627e...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3

  • Size

    248KB

  • Sample

    221021-wyc7qshhf6

  • MD5

    7171ee9dda00c1d5ff77a74aaf5a7e20

  • SHA1

    5c4a4e5348a42b2940041b451c397c9ec2d672b9

  • SHA256

    9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3

  • SHA512

    85764d54a990699a9b4d3f36c0475c6ef18f6a9af33e01aef8e448c109240f4a699b314d370af7add2c96d9aac9ff4be24bb6d1cf467bee588e7ea1ca03684dd

  • SSDEEP

    3072:KU4f+fkjZt7fF0L2vMCDiu0Y8RxwLRMcR9aBeWvfxLWDwNeWJ2NJucbPvJ1nlYZC:K1i+f3uBmLbR9JWJWAJYJuEvPr

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3

    • Size

      248KB

    • MD5

      7171ee9dda00c1d5ff77a74aaf5a7e20

    • SHA1

      5c4a4e5348a42b2940041b451c397c9ec2d672b9

    • SHA256

      9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3

    • SHA512

      85764d54a990699a9b4d3f36c0475c6ef18f6a9af33e01aef8e448c109240f4a699b314d370af7add2c96d9aac9ff4be24bb6d1cf467bee588e7ea1ca03684dd

    • SSDEEP

      3072:KU4f+fkjZt7fF0L2vMCDiu0Y8RxwLRMcR9aBeWvfxLWDwNeWJ2NJucbPvJ1nlYZC:K1i+f3uBmLbR9JWJWAJYJuEvPr

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks