Overview

overview

10

Static

static

5176d63c9e...38.exe

windows7-x64

10

5176d63c9e...38.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

  • Size

    1.4MB

  • Sample

    221029-qykzpahdc5

  • MD5

    0f546e7eb4be1a79cd2e15f67cbe42b7

  • SHA1

    bd706034409b6e6556920727c97e07eef28035f6

  • SHA256

    5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

  • SHA512

    8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

  • SSDEEP

    24576:ZRon1G/j+J1rUyv4iBImufwpH1RH17qhsaQO51HYrq/cHYIAmTXs0x/GphJq:Z8c/yHz/BfHRIUqcHBmb

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    • Size

      1.4MB

    • MD5

      0f546e7eb4be1a79cd2e15f67cbe42b7

    • SHA1

      bd706034409b6e6556920727c97e07eef28035f6

    • SHA256

      5176d63c9ea432c992ba2cf7b50aa915d7c672af42bd237308654d2ce5c5a338

    • SHA512

      8f2ce5cf7285227590736e6ba2352b80c1bfcd49ba3f5c54e405c7a835c6ff5f75d2e57f4f6f31f87fb986227180d72a523aff62680815b1a2dcbb278e578f3d

    • SSDEEP

      24576:ZRon1G/j+J1rUyv4iBImufwpH1RH17qhsaQO51HYrq/cHYIAmTXs0x/GphJq:Z8c/yHz/BfHRIUqcHBmb

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks