Overview

overview

10

Static

static

34bfe17b32...b4.exe

windows7-x64

10

34bfe17b32...b4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34bfe17b32cd412f787543a66f5346437e6deee3aa0c461ccbdd103d67b0e8b4

  • Size

    316KB

  • Sample

    221030-qhtlwsdadm

  • MD5

    84948e4fa2b962aeda4416452ebc2580

  • SHA1

    93c8154a6622a70574ecfd98858f2b4e05e48155

  • SHA256

    34bfe17b32cd412f787543a66f5346437e6deee3aa0c461ccbdd103d67b0e8b4

  • SHA512

    0fbb4223ef423742dbf180d3a03d5cccf22e7828abd4fb114b278fbc0b8c75c2fd1d93ad2f63597d2ef3004ad4e6621e6911966185a173984b117d13e8980ad0

  • SSDEEP

    6144:G8aP4mbZxGNp5cMzeJfH43t64qUe9jFwAGCBJEiCnlfX1Gx/ZLp/:ZaFf6p5PeBU6xUWFwAGTnd1G7p

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      34bfe17b32cd412f787543a66f5346437e6deee3aa0c461ccbdd103d67b0e8b4

    • Size

      316KB

    • MD5

      84948e4fa2b962aeda4416452ebc2580

    • SHA1

      93c8154a6622a70574ecfd98858f2b4e05e48155

    • SHA256

      34bfe17b32cd412f787543a66f5346437e6deee3aa0c461ccbdd103d67b0e8b4

    • SHA512

      0fbb4223ef423742dbf180d3a03d5cccf22e7828abd4fb114b278fbc0b8c75c2fd1d93ad2f63597d2ef3004ad4e6621e6911966185a173984b117d13e8980ad0

    • SSDEEP

      6144:G8aP4mbZxGNp5cMzeJfH43t64qUe9jFwAGCBJEiCnlfX1Gx/ZLp/:ZaFf6p5PeBU6xUWFwAGTnd1G7p

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks