Overview

overview

10

Static

static

92156ae027...65.exe

windows7-x64

10

92156ae027...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92156ae0272dcfcca8321221edcca6661d73bba80e9fa2fcb91af82dd6901665

  • Size

    636KB

  • Sample

    221127-b93asabe44

  • MD5

    17628cbf75f6fc89f0c0722f13757908

  • SHA1

    b4ce0d465640098c735c28435df8299ac2811f08

  • SHA256

    92156ae0272dcfcca8321221edcca6661d73bba80e9fa2fcb91af82dd6901665

  • SHA512

    9eab2a295578ac65e16c6ed57653ab28d5dece664e20d84da97160c5fb9b35c888e357611b70faa1664d6e97800f55c64ef87c0ea50af6cf4530eac4cfac16e0

  • SSDEEP

    6144:H96CO1VFnMjx2xicKEEyuaroAJDCbuj07IC1Q6YzP:Hev6sxffEyuAJDpzP

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      92156ae0272dcfcca8321221edcca6661d73bba80e9fa2fcb91af82dd6901665

    • Size

      636KB

    • MD5

      17628cbf75f6fc89f0c0722f13757908

    • SHA1

      b4ce0d465640098c735c28435df8299ac2811f08

    • SHA256

      92156ae0272dcfcca8321221edcca6661d73bba80e9fa2fcb91af82dd6901665

    • SHA512

      9eab2a295578ac65e16c6ed57653ab28d5dece664e20d84da97160c5fb9b35c888e357611b70faa1664d6e97800f55c64ef87c0ea50af6cf4530eac4cfac16e0

    • SSDEEP

      6144:H96CO1VFnMjx2xicKEEyuaroAJDCbuj07IC1Q6YzP:Hev6sxffEyuAJDpzP

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks