Overview

overview

10

Static

static

28d6ab8ea5...02.exe

windows7-x64

10

28d6ab8ea5...02.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28d6ab8ea59513adfbaeacfc0eeac01af84961c2597efd96f7e6160a142ab502

  • Size

    276KB

  • Sample

    221126-2cl6eahh73

  • MD5

    b61e284fd4e10513f55de906f6669324

  • SHA1

    e3e164e41098f57d1f4044c368268337a0dd783c

  • SHA256

    28d6ab8ea59513adfbaeacfc0eeac01af84961c2597efd96f7e6160a142ab502

  • SHA512

    e9eea51e4403a1405abd5179fcdbb396a1680c0b11f464b315257f0e242bf9a9681b324920ed64f7b7e3c7214b6c19294d0f91df8a31c4e3019684218fcb68f6

  • SSDEEP

    6144:NlLi/M8rU4Yewg4LKEIg5A2bjNIjZK/7l5rdjcH2xXmV1O2qZZ:No/M8FVwJzxJ/frh82m1+Z

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      28d6ab8ea59513adfbaeacfc0eeac01af84961c2597efd96f7e6160a142ab502

    • Size

      276KB

    • MD5

      b61e284fd4e10513f55de906f6669324

    • SHA1

      e3e164e41098f57d1f4044c368268337a0dd783c

    • SHA256

      28d6ab8ea59513adfbaeacfc0eeac01af84961c2597efd96f7e6160a142ab502

    • SHA512

      e9eea51e4403a1405abd5179fcdbb396a1680c0b11f464b315257f0e242bf9a9681b324920ed64f7b7e3c7214b6c19294d0f91df8a31c4e3019684218fcb68f6

    • SSDEEP

      6144:NlLi/M8rU4Yewg4LKEIg5A2bjNIjZK/7l5rdjcH2xXmV1O2qZZ:No/M8FVwJzxJ/frh82m1+Z

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks