Overview

overview

10

Static

static

3181643457...96.exe

windows7-x64

10

3181643457...96.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31816434571f0b2b01960f92770b57ac70cf6a0eb87bf58213877b14bd350296

  • Size

    1.3MB

  • Sample

    221126-2eet4sde4z

  • MD5

    d0b1208b584dc4b730f5ec52902a7540

  • SHA1

    7cbb8bbf7c97537bc3ac91e127b5882fb30e4340

  • SHA256

    31816434571f0b2b01960f92770b57ac70cf6a0eb87bf58213877b14bd350296

  • SHA512

    4de3d73be6770307cc99336054a3edae7ae9356109ceb48440721f6fc7caa77ec7bcbdf6d5cffcffd5f3d96beab7b55ce284fc0869eb09812e1d3d4d124797ca

  • SSDEEP

    24576:rtti5aupx0ivxg7SqnOhieQPl3HEeXji8w4acV6dd:rkaupx0ivg5OUeQt1XW9dd

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      31816434571f0b2b01960f92770b57ac70cf6a0eb87bf58213877b14bd350296

    • Size

      1.3MB

    • MD5

      d0b1208b584dc4b730f5ec52902a7540

    • SHA1

      7cbb8bbf7c97537bc3ac91e127b5882fb30e4340

    • SHA256

      31816434571f0b2b01960f92770b57ac70cf6a0eb87bf58213877b14bd350296

    • SHA512

      4de3d73be6770307cc99336054a3edae7ae9356109ceb48440721f6fc7caa77ec7bcbdf6d5cffcffd5f3d96beab7b55ce284fc0869eb09812e1d3d4d124797ca

    • SSDEEP

      24576:rtti5aupx0ivxg7SqnOhieQPl3HEeXji8w4acV6dd:rkaupx0ivg5OUeQt1XW9dd

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks