Overview

overview

10

Static

static

82fb7cce94...10.exe

windows7-x64

10

82fb7cce94...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82fb7cce94762a644bc7e320b1bde14f693c7e16624a84592f6ea8b519d0c110

  • Size

    222KB

  • Sample

    221029-gwqbysedhn

  • MD5

    7d31c5bae564a40de802cc01c4f53b17

  • SHA1

    fea43a3a19fbd0024c7b09b575f0f7e14fbeb790

  • SHA256

    82fb7cce94762a644bc7e320b1bde14f693c7e16624a84592f6ea8b519d0c110

  • SHA512

    ec194b90dbdf610e338139cb84961ea1fb46cbff5a4132125d9041b9559e054c74b37889f550769d8910f34cf95a8ae0826c8b591bf99932b45a584bcf82781f

  • SSDEEP

    3072:8U4f+fkjZt7fF0L2vMCDiu0Y8RxwLRMcR9aBeWvfxLWDwUeWJ2NJucbPvJ1nlYZC:81i+f3uBmLbR9JWJWdJYJuEvPr

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      82fb7cce94762a644bc7e320b1bde14f693c7e16624a84592f6ea8b519d0c110

    • Size

      222KB

    • MD5

      7d31c5bae564a40de802cc01c4f53b17

    • SHA1

      fea43a3a19fbd0024c7b09b575f0f7e14fbeb790

    • SHA256

      82fb7cce94762a644bc7e320b1bde14f693c7e16624a84592f6ea8b519d0c110

    • SHA512

      ec194b90dbdf610e338139cb84961ea1fb46cbff5a4132125d9041b9559e054c74b37889f550769d8910f34cf95a8ae0826c8b591bf99932b45a584bcf82781f

    • SSDEEP

      3072:8U4f+fkjZt7fF0L2vMCDiu0Y8RxwLRMcR9aBeWvfxLWDwUeWJ2NJucbPvJ1nlYZC:81i+f3uBmLbR9JWJWdJYJuEvPr

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks