windows.zip
- SHA256 3a09d26f341991e12c8f77d1eb3696bb3ae3a5d934e932686aa0d6659348f8ff
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lunar Client Qt.exe
Resource
win7-20230712-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lunar Client Qt.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
agent.jar
Resource
win7-20230712-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
agent.jar
Resource
win10v2004-20230703-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
gui.js
Resource
win7-20230712-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
gui.js
Resource
win10v2004-20230703-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target windows.zip
- Size 4.8MB
- Sample230804-b7kb7agh92
- SHA256 3a09d26f341991e12c8f77d1eb3696bb3ae3a5d934e932686aa0d6659348f8ff
- MD5 0fd4de4ee0504efcf39f6e6a198111c5
- SHA1 825597de1c984d24a2846a64a0935aaa8dd792b7
- SHA512 ea330fb0b14d2fc5b4b9b6fa4f698a6e24a3427f59dccf0391aaf4bc1b8c11099922a07ad2b22350a0ace993e77c16f873301025b2d5f07ffd644505ff66e4f5
- SSDEEP 98304:tPgf7tZjUfMH1uzG5idHqwaQAvb5iCwBSE8ejhpd4dd4WGZyLQim/LTytsQ:YtZYkH1V5EqwaQaqTJdK4WGZyL0/L+V
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Lunar Client Qt.exe
File Explorer
-
windows.zip.zip 4.8MB
-
Lunar Client Qt.exe.exe 644KB
-
agent.jar.jar 4.9MB
-
gui.asar.js 125KB
Lunar Client Qt.exe
- IMPHASH cd0d58b4fc105a233217d1b21b725090
- SHA256 43615ee12f289954e0cf91686e91c28410562f5263345fe02a6069a63e2a38af
- MD5 dd54085a14a224b91aa5cf0604cafd68
- SHA1 fa7fd70259c78236019baf398721b127f262f226
- SHA512 916fbf8aa5d67fc86e9cb9286fe978264d26c23fa58663fa46dea5121a7f393dcc9eeede7d7aac0580fbc1d0e6153060b2a9fc1470b34ff062d6a26694d4f591
- SSDEEP 6144:BfRQ3tKe9Rmn4xr0aT1LQC2iFS1LRJZ7UfghyMcBt9Bb/svoa8KIklL:pRg6nyrz2Qgh5e4rjL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
Major OS version
Entry point
406848
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
kernel32
GetConsoleOutputCP
MultiByteToWideChar
CloseHandle
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
ReleaseMutex
FindClose
ReleaseSRWLockShared
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
Sleep
AcquireSRWLockExclusive
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
DuplicateHandle
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
SetHandleInformation
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
TryAcquireSRWLockExclusive
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
FindNextFileW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetConsoleMode
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
WriteConsoleW
WideCharToMultiByte
CreateThread
GetSystemTimeAsFileTime
HeapSize
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
ntdll
RtlNtStatusToDosError
NtWriteFile
ws2_32
listen
bind
connect
getaddrinfo
WSASocketW
getsockname
send
recv
WSAGetLastError
freeaddrinfo
WSACleanup
WSAStartup
closesocket
Name
.text
Size
460KB
Virtual Size
459KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
155KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
agent.jar
- SHA256 29c7c75d11dd2564d9b62220e3cc527bf978b5a54741c3db2de4b72ca621e313
- MD5 ed7161236b23b35283037ed137061dda
- SHA1 71869ad9747ebaf4c5454b480aaa1345998dff96
- SHA512 6fe366f97d11c8381b0382a372910834272cb61619a3db7c179b0feb6ecf13b8d2f31e6cf681eb30cf9b88b328b495ac16cd4f2050b030ac80954c5e2f114c22
- SSDEEP 98304:bxfJ4FZhKyg7UVPBPgdyY0PFWECc4OTHrb6ILjlrWW34Dfyf:dh4FZh1pV5PJPFlhzrb6ijlrWWWI
- MD5 SHA1 SHA512 SSDEEP
gui.asar
- SHA256 a7ea0b9c9756660c759dfe5ba7739e698c087ee86e00a89df82640dc1a929e3a
- MD5 c416fa36965394ffa8b420981e162e83
- SHA1 bf0b28aed0db9c1a2501b5ce87ddedff79732c3d
- SHA512 03b78bd60b81c9c78d72482feee67305f01870bf623e9b3e06731b274ed3d190e369666c916ba7774f592e9a073dda37b0dca25278acaaf8fe1760698d13225f
- SSDEEP 1536:8psFxWGIgFxvH+1nPXeLiSB13D2Aia4dN7AtGyaWeLgUwXWAE/W:3HkgwnPiiSB1z2A5477A0WeLgUc
- MD5 SHA1 SHA512 SSDEEP