Overview

overview

10

Static

static

66d60762a7...09.exe

windows7-x64

10

66d60762a7...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    66d60762a72239205e4dc4e2c3d2e662ae6462b9d675c094e5a6d771fe11a809

  • Size

    222KB

  • Sample

    221126-11hx8agh96

  • MD5

    88a5eebc648221d89ee054dd1df207be

  • SHA1

    ae66fdee2af58dca79f43e598421af3fa407bfab

  • SHA256

    66d60762a72239205e4dc4e2c3d2e662ae6462b9d675c094e5a6d771fe11a809

  • SHA512

    d306013c406131cdc3623322e37f0ef2f98afa023444c2d5fd30a69813524169264aa85eb8781e8fa207c3858afbd6c8093fb77385c71fe730ee6ac3d8c7dbb9

  • SSDEEP

    3072:8U4f+fkjZt7fF0L2vMCDiu0Y8RxwLRMcR9aBeWvfxLWDwMeWJ2NJucbPvJ1nlYZC:81i+f3uBmLbR9JWJWtJYJuEvPr

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      66d60762a72239205e4dc4e2c3d2e662ae6462b9d675c094e5a6d771fe11a809

    • Size

      222KB

    • MD5

      88a5eebc648221d89ee054dd1df207be

    • SHA1

      ae66fdee2af58dca79f43e598421af3fa407bfab

    • SHA256

      66d60762a72239205e4dc4e2c3d2e662ae6462b9d675c094e5a6d771fe11a809

    • SHA512

      d306013c406131cdc3623322e37f0ef2f98afa023444c2d5fd30a69813524169264aa85eb8781e8fa207c3858afbd6c8093fb77385c71fe730ee6ac3d8c7dbb9

    • SSDEEP

      3072:8U4f+fkjZt7fF0L2vMCDiu0Y8RxwLRMcR9aBeWvfxLWDwMeWJ2NJucbPvJ1nlYZC:81i+f3uBmLbR9JWJWtJYJuEvPr

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks