Overview

overview

10

Static

static

b2e165f6a4...ad.exe

windows7-x64

10

b2e165f6a4...ad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2e165f6a4bcc9a723f638c8fbf981b110a122fba4d14bcbcb889a38f6a1ebad

  • Size

    1.2MB

  • Sample

    221127-cs2hlacf58

  • MD5

    467215da381b86f26f351ff8f9dd68eb

  • SHA1

    e1ec23d03281b769b829746b80d632daa7cef167

  • SHA256

    b2e165f6a4bcc9a723f638c8fbf981b110a122fba4d14bcbcb889a38f6a1ebad

  • SHA512

    325597a499dcf8e92144bbb4ba22c817e316b58bf75e4b9abb7de240687f159842e5fe5b70bf514093f403f415fd871bcbe6c14a8ff39e7ef136715464322e07

  • SSDEEP

    6144:FZpoq7VZyVG2nm5ITdgURnwe9TU651/XnGfQuYJmeoc3wuNd5t/Vypfdn19w4:zHyBmuTdVdH6YJpAuNdH/VyD1e4

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      b2e165f6a4bcc9a723f638c8fbf981b110a122fba4d14bcbcb889a38f6a1ebad

    • Size

      1.2MB

    • MD5

      467215da381b86f26f351ff8f9dd68eb

    • SHA1

      e1ec23d03281b769b829746b80d632daa7cef167

    • SHA256

      b2e165f6a4bcc9a723f638c8fbf981b110a122fba4d14bcbcb889a38f6a1ebad

    • SHA512

      325597a499dcf8e92144bbb4ba22c817e316b58bf75e4b9abb7de240687f159842e5fe5b70bf514093f403f415fd871bcbe6c14a8ff39e7ef136715464322e07

    • SSDEEP

      6144:FZpoq7VZyVG2nm5ITdgURnwe9TU651/XnGfQuYJmeoc3wuNd5t/Vypfdn19w4:zHyBmuTdVdH6YJpAuNdH/VyD1e4

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks