Overview

overview

10

Static

static

15843008b4...29.exe

windows7-x64

8

15843008b4...29.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15843008b449ada1a722b2ea3ea46d3180d95995d8055181d884840f3ea7d029

  • Size

    2.7MB

  • Sample

    221126-11btxagh86

  • MD5

    c8cf5b4e0b41f78a0578afd13d721fd1

  • SHA1

    3c5fea380843bff19cf435322ec7a8a62d1ec3d4

  • SHA256

    15843008b449ada1a722b2ea3ea46d3180d95995d8055181d884840f3ea7d029

  • SHA512

    f4bf2b8452a253aa45f64c6d05d3c7a1e8ec744a322892e1f03710129e43fa63f0064023341d37dd308be45c9385d50863d2b21461f82e94ba0e67526708c54e

  • SSDEEP

    49152:eSBec0GPbErgBAmCke8D/MABBqVbKJ04TiSgviLoDbrBcp9:ecrzErgB+wM8IVmCiiLvxnrB

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      15843008b449ada1a722b2ea3ea46d3180d95995d8055181d884840f3ea7d029

    • Size

      2.7MB

    • MD5

      c8cf5b4e0b41f78a0578afd13d721fd1

    • SHA1

      3c5fea380843bff19cf435322ec7a8a62d1ec3d4

    • SHA256

      15843008b449ada1a722b2ea3ea46d3180d95995d8055181d884840f3ea7d029

    • SHA512

      f4bf2b8452a253aa45f64c6d05d3c7a1e8ec744a322892e1f03710129e43fa63f0064023341d37dd308be45c9385d50863d2b21461f82e94ba0e67526708c54e

    • SSDEEP

      49152:eSBec0GPbErgBAmCke8D/MABBqVbKJ04TiSgviLoDbrBcp9:ecrzErgB+wM8IVmCiiLvxnrB

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks