Overview

overview

10

Static

static

09c8b67a5b...78.exe

windows7-x64

10

09c8b67a5b...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09c8b67a5b156e19ab658b1342cfed35eaad3d897920369292dd6e8635fe3278

  • Size

    686KB

  • Sample

    221126-15xl6shc95

  • MD5

    c133af251d114065265e9827b630239d

  • SHA1

    e13b3859d3a136a21ae1284bb3db431e2adc5e86

  • SHA256

    09c8b67a5b156e19ab658b1342cfed35eaad3d897920369292dd6e8635fe3278

  • SHA512

    39ceb34df4c300e5a924cbeb6af181d3f7c3ebe16f9c9569a4eeaf285ebcf7bf6ea50a20eb5b0da67096098f857702089b0103873e03f7bf580b4fbe0ab59b8e

  • SSDEEP

    12288:CKTwwbIjoyUi2NKi2J0V+IpsLQbKwBYRa72QB+uTFzdcvux02S/JfVOCU5vI8Jog:ZvIKNCJY+IpsLYKwuRa72QB+uTFzdcvY

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      09c8b67a5b156e19ab658b1342cfed35eaad3d897920369292dd6e8635fe3278

    • Size

      686KB

    • MD5

      c133af251d114065265e9827b630239d

    • SHA1

      e13b3859d3a136a21ae1284bb3db431e2adc5e86

    • SHA256

      09c8b67a5b156e19ab658b1342cfed35eaad3d897920369292dd6e8635fe3278

    • SHA512

      39ceb34df4c300e5a924cbeb6af181d3f7c3ebe16f9c9569a4eeaf285ebcf7bf6ea50a20eb5b0da67096098f857702089b0103873e03f7bf580b4fbe0ab59b8e

    • SSDEEP

      12288:CKTwwbIjoyUi2NKi2J0V+IpsLQbKwBYRa72QB+uTFzdcvux02S/JfVOCU5vI8Jog:ZvIKNCJY+IpsLYKwuRa72QB+uTFzdcvY

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks