Overview

overview

10

Static

static

b9694c6ae1...f5.exe

windows7-x64

10

b9694c6ae1...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5

  • Size

    267KB

  • Sample

    221127-q66w5afh41

  • MD5

    03f81f69db69634c13210bae6b4598f4

  • SHA1

    6710382e4f58f97f99fca1ae6b189fcc67e9011d

  • SHA256

    b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5

  • SHA512

    f7f8cd15d01fd26b03881811e27356179deaafe3afd6a1b7b908edbab0357f52d8c3753c179c666c6df18e32cd784252c4cd92cd7e1ff21bd1981228708aa1f8

  • SSDEEP

    6144:LIl3YnIIHBJ0X4U3cCIUqWzInoBdm4XORyGB7W0OnyYLSAXQ:ElYhQ4UMCIMdw3BTOyYLlg

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5

    • Size

      267KB

    • MD5

      03f81f69db69634c13210bae6b4598f4

    • SHA1

      6710382e4f58f97f99fca1ae6b189fcc67e9011d

    • SHA256

      b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5

    • SHA512

      f7f8cd15d01fd26b03881811e27356179deaafe3afd6a1b7b908edbab0357f52d8c3753c179c666c6df18e32cd784252c4cd92cd7e1ff21bd1981228708aa1f8

    • SSDEEP

      6144:LIl3YnIIHBJ0X4U3cCIUqWzInoBdm4XORyGB7W0OnyYLSAXQ:ElYhQ4UMCIMdw3BTOyYLlg

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks