Overview

overview

10

Static

static

3

cb7d74d368...fd.exe

windows7-x64

10

cb7d74d368...fd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd.exe.zip

  • Size

    930KB

  • Sample

    231201-spm4sscc69

  • MD5

    0bac9d44c96a998f0398a0dd43839b56

  • SHA1

    26f324148cf7e0c7e65a287abb5d6c2956a60412

  • SHA256

    ae192099d8abfa67a49b100223a764cb4e227132e54f10c8ef2bc7bac185c49d

  • SHA512

    7ede6099842577f01b8e3872732429e42ab0dffeebee28b0fabff224e6025b7fa5b9c55340a84282cdfa8f945c777b83449b362d2cce2aeffaf6580cb0725548

  • SSDEEP

    24576:gYILGnR6RZ6BWy3iczzSJIdlQdRp7M+wq0stvcA6NBW:LSZayAzSJVp7B0shtYo

Score
10/10
luminositypersistencerat

Malware Config

Targets

    • Target

      cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd.exe

    • Size

      1004KB

    • MD5

      17f83bc21dfe5a240ffe81217f0d892f

    • SHA1

      9f15af376dae479aa706555e5509322b018a99ba

    • SHA256

      cb7d74d3686c2832d6bbf6bb9a5f20e8d0d0e7f48fd0c8d6a3b07e98769e59fd

    • SHA512

      7490a3bd7bb698b571fc443e617615ad7aac338f9c6b844078ea3de3126b2eb91c904f8b0d8c9806ab0abf254a7bfb6595c993faab60be0620934ad5ed8c2979

    • SSDEEP

      24576:xE/NU3dLfFe1gAS0LE2ZKc9PSEH0uZuLfSA5yN4spZjpVcNTkJXo:EihxASPsaEH9ZuL3udKTW

    Score
    10/10
    luminositypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks