Lucifer_21[.]zip | Triage™

resource	yara_rule
static1/unpack001/Lucifer/phonelookup	upx

resource
unpack001/Lucifer/cnc.exe

Lucifer_21.zip

SHA256 07548b3bd8978a673ba74f5949d438685b8e569e092d057d04f305655714494b
MD5 bc5a64e94d9ae6a90d1e3e5527aef946
SHA1 537c3fc0c54a8bb3dc8e8651c645dae30662fb17
SHA512 ec301b266fdae6a87ed439ac274803ed9f549cd3f880403a55e1a803f3c1ee758dd48fb1f98a1cbc85cd9f2ce9bc82dac936ef5884a19674602e8cca8a6fdc3f
SSDEEP 393216:78VilnYOjCeWHx3j8iAAUgBZZaMWqOqzZCeMlqmE9ESt3inwnqiSWh5ohxvvhxj3:78IGOjKHZ9AAUg8VqOqVhErE9v3iPWQp
MD5 SHA1 SHA512 SSDEEP

Lucifer/app

SHA256 5e3f9589289caf3a765c5c1a678a43fbd8707b7606950018a6d95e0fca9fbf36
MD5 ea97fa450151bf3fbdd9a492d5541a9f
SHA1 fd75f43c87793ce2559873d0108cb1d8c327abb6
SHA512 c184cb9edc335a9e9faa2db0c8ca980c022b993363ee0536d4319f9d276ad16053f2917dec91ff85a7ba5fb8042bd211292c237778dee546ecec6d1e3d3dde88
SSDEEP 98304:qqVzd5eXHIrsFCPr9nznIzc2cPy5+A3zNZjqUe1lQGIoygj0QoJ:q6dCHIrvPxnzHyNZj1eoVoygYQW
MD5 SHA1 SHA512 SSDEEP

linux x64

Lucifer/attacks.json

SHA256 90412d9f174fc3714efb73d7a50c14cecdbf871533732f6cbb27655311fb6fb5
MD5 a5c5c93be49bbe4a92dc335ddcefa27e
SHA1 f763c5ec3cbe6d9e51ea097615d03a97921318cd
SHA512 5702d107296da00390f24cf02f2eaefa192d2304d82f600da013901734c5f379e32687834f0ad1e6000c191494629c86add5f8b5132ab4919365e53da214df89
SSDEEP 96:AfozaTB+ADp4+Ap/+shg/W+ADy+ADsa+AoZp4+A9lt+AC1Ay+A9Ab+Fos7/+A5x2:AfozsZpmTO/uqwpqtBzAJU
MD5 SHA1 SHA512 SSDEEP

Lucifer/branding/admin.tfx

SHA256 6055ce50b13b10ec337477517933775e7aabe55d7f38d04ecdac7c2c4baf6f5e
MD5 d936f331bf5b8c9b477d31007eab21c1
SHA1 2f96622785fe208135e5b4475f0ba1aac57a4dac
SHA512 623d94d825354643c3888d90a888109fd26f7c6d427769c938b7b4748580b3826d55c361f5af542db0858e26d80ecb1309d8ad689f5ba687274266064a57921a
SSDEEP 384:hlcpaqx5BeTQ83g6wPELZ3UmOrdESAnRap1LlRlcpaqx5BeTQ83g6wPELZ3UmOr/:hlcpaqx5BeTQ83g6wPELZ3UmOrdESAnH
MD5 SHA1 SHA512 SSDEEP

Lucifer/branding/banner.tfx

SHA256 257483c3af4a0eec05a3901a91af0e1f85d379f22b362a7018facbd2f1ab4697
MD5 04d661d0cc3b349f9a3ea796a4fe12a1
SHA1 4905436d6d26cac3dd87fbe8d329dea735ba927e
SHA512 5133b6d298b774f6303892c06ca439452a83fee2b68e93f6ec77dc19edfc219b284a27befd6e10840f9659ebcd432855e57027342104d8c839a0284cac5cf321
MD5 SHA1 SHA512

Lucifer/branding/credits.tfx

SHA256 73c2874851bcb34d1403582c2c143a7d3ca29f0b0082a8458748d192de2d4f71
MD5 4f2624218fcaf3bb0cddfa6822bcbe9e
SHA1 72433afb875944da1462a17a36871810e0808cfd
SHA512 8f9c73d0588eeb9b9e078500c554e513c210a132427d11e73ed80adcf2b61e72e4b707b4e7017c21c7bb48f9dae84ad532a8465d47541b55fc89123881c69311
SSDEEP 384:hlc/5caBciWOg6wWSemUm1PUXXnxLGvO1KHfblc/5caBciWOg6wWSemUm1PUXXn3:hlc/5caBciWOg6wWSemUm1PUXXnxLGvo
MD5 SHA1 SHA512 SSDEEP

Lucifer/branding/expiredmsg.tfx

SHA256 498fcede2ecb5c1562c2ce93b2ad9ba5de9045a9150bfee45ea24619065f8728
MD5 ce50d8435c76d1689db6cabaaa25bdb2
SHA1 66f0efd7975e14413f18760fec43a10672381ef9
SHA512 5d14be47c0965e3f1de4d6314aea03bb26f85324a4e82991f10d0fe2e55afd110c3b94a13b8806a3f6bdccb3e27388d612017eccc6805a5b725106feea038e10
MD5 SHA1 SHA512

Lucifer/branding/failedusermsg.tfx

SHA256 0d8648a4e8156b74be35dc070343dc65da4897e37d9f3b8e363ad66514e48385
MD5 20c30b1fdbc4cf83491989d9dcafc7d6
SHA1 f041063426e07f83967b1b44bafce7145f48e9b6
SHA512 f9a1531764c825678e13edafbbd39d0c753aff403f07b31acf19c245eef36ea8fe9b309153243e8c8f23206f2a251f4b25b7ab1107d6a00870ad7e25f8d340cd
MD5 SHA1 SHA512

Lucifer/branding/help.tfx

SHA256 2146a5a5f7b1899f2215344cd4415a1c98a8bf376b17c9bde08bc05f541bfa23
MD5 7fd7d2e3eadfa9532683ec2e7475c27b
SHA1 4cca4b4a5ad9abb9afa076e0704f229a25ee8d2b
SHA512 b20064efbbddddbdac20e10bef243ce51c36d894f9a802beedc0b07868d49ff8987c0289d8250cfc6f7f94445b677035270b632ab0051bf90c68c038b751ff3b
SSDEEP 384:hlcM5ca8eTx+wKIrlIwkhkQAESAqxLGkOhkqdlcM5ca8eTx+wKIrlIwkhkQAESAI:hlcM5ca8eTx+wKIrlIwkhkQAESAqxLG7
MD5 SHA1 SHA512 SSDEEP

Lucifer/branding/hub.tfx

SHA256 b957d4323389ed958a455379538b544c3d29cb2b568d1feb835c85f25be4f7da
MD5 29d880bd55f8ef72edc3f5f6aa1e8339
SHA1 f44f09a5e1dba7504b231d029329c7328b6b34bf
SHA512 6a457938c2c3ac79ac453c585813bfcfd2e10091b67e82d078547626923faf429f3c1922c224999afb242661cbcf709c9dea2622c8733d5ee66beaf7467adfe6
MD5 SHA1 SHA512

Lucifer/branding/info.tfx

SHA256 f210cc82e990ab535ec0e305af16b8d9f9f2a5edd33d705eecd1fe924aae1251
MD5 c64663d7d07f18e0ed83855737b78e15
SHA1 db4e00e7f4faa4cc797e461c486d5932d2f209e6
SHA512 c672301b75f04fd65c8e9c524ae996be80f48a2a8e1c2fdb5521bf2a3ecca58bfe52e8a720f1a550104218bc40ad8f709e68a600dab3b2a114eb2d6d226d09d3
SSDEEP 384:hlcMUca8eWQ83zLrlLZ3Um1PJXsmRP5TG1MSlcMUca8eWQ83zLrlLZ3Um1PJXsmm:hlcMUca8eWQ83zLrlLZ3Um1PJXsmRP5P
MD5 SHA1 SHA512 SSDEEP

Lucifer/branding/layer7.tfx

SHA256 b2e70ed896755c73389bccfa4f90708994ba5b8f38d9433b4dc583cdf0c0f30c
MD5 ab3dc41fe505b2e0f1e6f84651ffd1be
SHA1 77fcbe3d1cee53535fccb375190c56cc55008881
SHA512 c59756e73af6d952358ca3711313937a6ed68b7f1707a8b8c21a65c10687f7df42c33434be5e6fcdda1bab495b2b657088dd01cd1c6612cd64e769d1f55921f3
SSDEEP 192:iQlcMa8dx5Bcix83zL6P1I2pkhk1P25ZtsxeMm+6lcMa8dx5Bcix83zL6P1I2pkb:hlcMaqx5Bcix83zL6P1Iwkhk1P25ZtsB
MD5 SHA1 SHA512 SSDEEP

Lucifer/branding/loginmsg.tfx

SHA256 cade5ef7b4e5517180f5c67b5717c7f26a3d2a20ea5f4b7f6f9f58baee348bb9
MD5 4b45bc2ddfd21892d91cd48b535dd32b
SHA1 447af8d3c3fcbc2c0f690556457196817c40b71f
SHA512 85db2516ae979a4da28a04ee467c49d191a28e9578d239e21d87ba7df9ceddc12ce9b7e7048c2b9bdd0300a184bd219729ecd06bdd283eb87aeb3ae5bba01deb
MD5 SHA1 SHA512

Lucifer/branding/logs.tfx

SHA256 d61d203ff03d99fda5d84499646915c40a84051cd60eb58214d412cedcefb54d
MD5 1a86480fed2b797784c06a2783948ca4
SHA1 bac9b0505fdf3aae0bac4fe627b7d887c582a5ec
SHA512 a527301065873296e5bfd5c6f6e975a443f055d19c6574e52a6c9a8fe72b1661e4cb7ebaa153f6fb307e6ca1ee4f65761c623e5c02151385ebac20a043956230
MD5 SHA1 SHA512

Lucifer/branding/methods.tfx

SHA256 09bf83902f7d7070878104a8ae94782b4abe5dc915d7908c091ebb371b017a02
MD5 987b773de8805043ed3abf10638e7b48
SHA1 aa45003b347c055a2f00d64a8f4af5bbb15f8964
SHA512 3ca33116641aaf90ddc245d347d89543a0accca6cecaf94b960b6f1a26ee7d6eb21a28b400b268b59910a0387b26366d96be5e0c8abd4598dba265a81790b2f8
SSDEEP 384:Ra8eWQnOg6IrlLZmLCJQAUXstssGKMlcpaqxa8eWQnOg6IrlLZmLCJQAUXstsh4C:Ra8eWQnOg6IrlLZmLCJQAUXstssGflch
MD5 SHA1 SHA512 SSDEEP

Lucifer/branding/msg.tfx

SHA256 6551d37bcdc331c18ff0cb368a1aa17e32ac19d47f409592249bc2ff48b57d7a
MD5 c2e93aaf7e21ebd03001fb9cbb3248c0
SHA1 f29fec733581a88b6594712360f4d70b06508b2d
SHA512 0aeb6761e46f074de213bbde19b8c612ad039fcc20a5c0bc849c234f01c9bcf8179bb9e10b2c41d996b90e4d37f41c02d8830cfd99d8d9d7db39c2119db36ea1
MD5 SHA1 SHA512

Lucifer/branding/rules.tfx

SHA256 ff93014af57901a37645a9aac6c79dbc260e28aa5ffa95cd1759c796897cb41c
MD5 9e06f994b74665b8b033895352b66b7d
SHA1 2ed3c3fd7bf238e061962528935e23c869384db0
SHA512 0d40ae221fe92ec704b4877ff623c38b74a601808d4b869732d5e86d1d2db8c7a5d3ddf8aa05c03d1c1a59fb8d6e8210fac9492b0a9a101dc027271e5df0b0f9
MD5 SHA1 SHA512

Lucifer/branding/splash.tfx

SHA256 7bbb7e12ba7b92969950423de76f64ec27626aac6d8594b48b455973f72d27c2
MD5 6efe445c42ec57f2f7924dbb33ff0c29
SHA1 ee2aeb0f9c41c036667d792f1743e50b6b9ffe4c
SHA512 85359a9f263dc8ae78e739212615df7d773b57504496ab193ef18680b3e400ef2853280c1f8878ca603ba08427f9aba045d45ec8f6a7a47deb511ba4d955c911
SSDEEP 3072:5KcKc6nvnO+O0smnG4+JnR1X4sG+p52i6UunHt8fw84rN6g5zTS/4:e
MD5 SHA1 SHA512 SSDEEP

Lucifer/branding/tools.tfx

SHA256 e7ab4393867edac46f0f8a3334b8cfa0c659f76254404c57c0f6f1eca6407520
MD5 92d1d945d43fd377fde2dcd710e0f4b1
SHA1 d0fd62870e5cba1c7fe0184f87ede580979456c1
SHA512 bef4edce4b2a82e93bc3e92693fc064fa57984df1fb3b7faf9f6e27162d7baa64277ca1784a3b1167a97d2ea4909047022f3960068303f2c9cad242d89c60fcc
SSDEEP 384:hlcM5ca8eTx+wKIrlIwkhkQAESAqxLGkOhkqdlcM5ca8eTx+wKIrlIwkhkQAESAf:hlcM5ca8eTx+wKIrlIwkhkQAESAqxLGQ
MD5 SHA1 SHA512 SSDEEP

Lucifer/build.sh

SHA256 f355932f01656cfb4af1e8bbd8e8f2aa7813cf2f29fb404714ea727db2282713
MD5 cb6621bbdc434ef5a80b802493797a13
SHA1 7bd297368c455f924343c28eae03bfce7ee28d6c
SHA512 7ae917e07981c2c8e800efc46f6a8632fdd1c8705f17153c17f2a459d034d66f6cb5a9bfa4cbfb3ed089c91c0e7c6417e60dea8ce02692ae511ea41e2e8ce7af
SSDEEP 96:rq2vwpKXg5YyHv6GFeaaZL+8H14TVk/KT1Bu/itE6jQDQyQXVQaiQBQYRQsQXXQF:fG8I4MBgOEQfULHSOyeLObNYsw4
MD5 SHA1 SHA512 SSDEEP

linux polyglot

Lucifer/cnc.exe

IMPHASH c7269d59926fa4252270f407e4dab043
SHA256 a494436b195930d7debd547b0116e26563e480cb33c50667755a014f9983ca03
MD5 c549b0c14717f5612fa26a06a73d503c
SHA1 80e6e39f076978d8a7ef7913232b44389da901ee
SHA512 904fd451b363aa51aa64a81d3a0aa7bf02ffa0d4340438031ac5f764439ceb4af1658f1234df2898e666fc65327021f63dc4a75db19b8d6c8bcb086fa7a833f1
SSDEEP 98304:GVhwrJqAYNUui8i3FG7oRherab4E2n5/2wdMIaOW14PG:g7NNVW3FG6hzxAMI/s4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

413408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

395KB

Virtual Size

778KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

512B

Virtual Size

281B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

451KB

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/65

Size

685KB

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/78

Size

571KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/90

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

367KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Lucifer/cnc/attack.go

SHA256 c55953fd724180a029e3bb4959639b2f41196dbb66fbff5c63098a4fae2b9aa5
MD5 946a51813245807f676dfb49b04aaa7d
SHA1 2f6d8d7dac6599ad4530bdaeff82d8be20c86195
SHA512 55b20943f16899b3fc375ed204a98d9f48073b7f5f3dea782cc920b4a0f6c510f4ed499e3af84379d2937dd57d294198b3391ae6e251ba64b1425148a7151c1c
MD5 SHA1 SHA512

Lucifer/cnc/auth.go

SHA256 1fe82a0aa6b4babd1d260565ddaeef61ed4ef6282aa3d62970563c30a9dd457d
MD5 1a1a27e9f4587d33e0d35f17f52543f2
SHA1 eab6e3443176ba9b6e036209040208449904796c
SHA512 52d9db1975a56f2d77e3297325cdd7448c8117a394ef4dd0ad88d61172d9ff1704aa34421b3a67c27516cc785ab5756761035869801aec31a63fcb91386df04b
MD5 SHA1 SHA512

Lucifer/cnc/branding.go

SHA256 8b23902223356f336db3418fff881f53a63bdca89155d929f0513fb7f1fcc2ba
MD5 00e9caab049f15503272276f0810c7a3
SHA1 f57fc9584d8a0b02d66bb03088fff02f110d9e42
SHA512 f3f6964d88ea0eca4e64e6b7a9b33d252f3d2a3c78ba3772e5b5db6609bcafc3e3dfb1a45750e02d687cdc50f08f0dcc9707c7d2ba57cdda024bd0a705b0486c
MD5 SHA1 SHA512

Lucifer/cnc/captcha.go

SHA256 a06546c43737741cfce4f19977eb826959aa453f8fbc5d786cfe9ce43c173847
MD5 69d4b2f30b48b6af758a72664a23886e
SHA1 d0d40fe53cb854761b081d97f57086cd0e2c7100
SHA512 627a2fe46be2c9fcdd46701e0bf77dd198203c51e3100aad9bd6e782a10ca449c04cf4a5a97e18dc8911947e8f10a7dc564cf7838a2b83fc1995ea9e100a8f30
MD5 SHA1 SHA512

Lucifer/cnc/check.go

SHA256 af69dad9fe8a429015837a21ae9112f7a47f9c6247e78f2c79086bdadee0de2d
MD5 a3d18861b84700ebd3808eb66965b141
SHA1 21c287f4807e7cf607ea164799316bd69fe01e4e
SHA512 31efab9fe8d659560d127f79a9f769d58dbbfa8c1dd69f2f6ece576c5bec0de59e245194fe80a01ac8b3745a50a6cb4971124e666f7315e1f79cbdf3ae2c3025
SSDEEP 48:w4ccAQQ3dVLQQ3q4YQQ3d+DQQ3dkC6QQ3dWrQQ3dw3LQQ3q8y:B1liKn4tiTi3niJiNnZ
MD5 SHA1 SHA512 SSDEEP

Lucifer/cnc/cnc.go

SHA256 1d6056e52e158ce60e08b1548b96b42fb210285d59d02fcc96086d7ecf0c9588
MD5 dc3e564cba2151e3ad8c249761397f69
SHA1 ecfe39216aa1c56b9e7286f08f96894532326879
SHA512 6627e2064755a9c59d62a6a80f304d0e26cffdd6283419789b5dcea49db70a3274e8913aab278fcc5b49ffb900b96573cc3c50c005f642fbcc0da990cf1ec3e8
SSDEEP 3072:Ixq09dTwWSIj49NP/CHViTwWIjVNPCHPTwWSIj49NP/CHViTwWIjVNPCHKQruVRy:l6ZJ
MD5 SHA1 SHA512 SSDEEP

Lucifer/cnc/conf.go

SHA256 96f21d79d26694b9ff3dd2c15f5646220416397c9694ebf2786c2caf861a2489
MD5 d8f69ae164a7532531e928e2315d1118
SHA1 eda1289b8349336851fe7166b211544fabafbf40
SHA512 2d10dec572187d4a091b41df0cf730833c82b4e6d9c6fb314e4625cc2eb1ca4bf42d1aadb55e9fca87f4ee7556c3dd3650b5bbfa3e3772b33873dfb13dc17a9d
MD5 SHA1 SHA512

Lucifer/cnc/database.go

SHA256 4e1ac9551a19051f1e38a6ea96950200db8816c31dba37804bb25d97294ee40a
MD5 3f56cd14a6e48d17d7ad63c17fb1045c
SHA1 3f41a9d97f74cc95b727a28e8315d94fa508191e
SHA512 49c9baf0a682566acc658951a492761c24469985a0db2ead4be4a2dc77d36872c6b1ab2227ec12431335f562a7ee48bc0f5932e1b2da53ae26d6020c706970cc
SSDEEP 192:tlR04lRMMzVoBylDNZXm+b5l5HyG8Jc0sUc666kRHQtU1B65aMn6LCUPYKb8Ypbj:tJrnbQOlgGesiHMsUu596LLPB8atR
MD5 SHA1 SHA512 SSDEEP

Lucifer/cnc/execute.go

SHA256 4db6dc4d1b4eaf4dffbe450c1ac0418af3aab9cd6637eb12c2be25f22a78667f
MD5 7c02c4199a1a19294c2c5e4098fd99ef
SHA1 94abd1e33a815707760acdfa97fa68bc9c2fdeec
SHA512 5174006617a99b1014e26652006d1609e393b25b41ecdd218f6f26eff0bbdb27479aeb00903ed75895e6449e78e3f7563077107604036211e303e4ad2f31c722
MD5 SHA1 SHA512

Lucifer/cnc/functions.go

SHA256 99160acc2ac059d6c6a3ca7cf1b177492c2a70b2c3236506400e3655bfbe1863
MD5 77453de57dfdd6ba462be58d178f7180
SHA1 7c3020d9e9907816eb41eb7b7605d0c8d3022922
SHA512 9d4049e4f44e08526e20e90e2a9f1f931e10cf7fe07ee9d05b99c3d226446b4cf61881d80932e8346a179c2ba3e4e90d0b4f106b3546a82fc6f568751454c20d
MD5 SHA1 SHA512

Lucifer/cnc/iplookup.go

SHA256 97ae3a34f3c9b9eded787161170623d28a62312020f81f70846a164ec6cbc6a8
MD5 c99d16a20a65ebf4ca80e931cb02699d
SHA1 16bad3e9d4a4752f36d265e8140f5540103227a5
SHA512 e46d25fbac29a5d01595eb0472aec22d3f13aa9041fd6c4203a853ec7f388a2a541b3cdf462c016bb275388c1785a95c609100914ae53bb56388ac919bd7f801
MD5 SHA1 SHA512

Lucifer/cnc/main.go

SHA256 93f0b5dd31f8bcee91af4cc9e70e25552b9a150cf14e30f83153646ff946c6f2
MD5 d2188521a300cfe3e872ee8d94b9befa
SHA1 ed483cf7e39b5cd5ee481d5364ce43764eb162f2
SHA512 ffa4d4369f4e2596aaf9f3ff3d500e46aaabb5091002103eb0c9c1948776bac7e08922095d71c0ac5ef0af1cb9409fb60ad44b8dccdd9b6a35ffd95f3a04d8b5
MD5 SHA1 SHA512

Lucifer/cnc/pass.go

SHA256 cdd8d7cd0edc5b6ad75b83e7f3546c323384ac48a3891c5915ad25cc13d72c48
MD5 9439d276e25e27d2adebc30b1dfb3d30
SHA1 a8d4cb3b217fc8f863462a1f59213cd1924989da
SHA512 411a10bb8f8571c051590a06ecba0191954a658c9b4d0bdef6711c82dbce5b572412763bffc30e7be19fe4ec353bfc58c30a1fb866fd657e29a4d470def4442f
MD5 SHA1 SHA512

Lucifer/cnc/poly.go

SHA256 0bfe37611ee1cb568fe3c584e4993af11d7ceac0919e428f7312b6cc2714b2b9
MD5 700980c09aa67df00bd8dfc306302bda
SHA1 06c47afc3951027cd4b9eb9306be156ab0dddfbc
SHA512 e9b6387bd5c9d7b78ab5eafbded160710beda49e2a99bf85deaa6d74d6ce562c903a636b488c3f148ab28b82a55a8c3b40438b761880af3a5ca7bcfe8c0239a0
MD5 SHA1 SHA512

Lucifer/cnc/qrcode.go

SHA256 974b7b8d79bfc4d58410cd48be0d822484959a86e9ec6eadee1edb86803cc3cb
MD5 f360d5c489e91511857f2ff642ae6a9f
SHA1 ef1e5f273c0006282d5a0851cf19f2d08a9c9fe6
SHA512 7886aa1d6eff51bd01c7365b1da5279988c8905a1bd068a424f66c9aa1c7b4a904ce6045adc610b2da1b603c343d64bd62ff2c87dad8ad62efac85455f58dbbe
SSDEEP 96:Oq77kvYfR7QBdx6E19Q5C/UfJnrhNtKhOrUKCrTdxAa5fz8:OdBdcfZhNcOVsxhY
MD5 SHA1 SHA512 SSDEEP

Lucifer/cnc/reader.go

SHA256 d5a2db82d4b0630d46f1b8e63fb6fdc5ded0a96369355717d8755e91e249624c
MD5 bb4db19d63671452c01cb72632b2d390
SHA1 4412798f54bc6395b1f016521a44d04aa61e5666
SHA512 a958fcdb180d5c83afab4a019a86b50bdd98337ebeb928d6d0837747eb3d484ca0efe47fe58e2316183c77b2a8d600bc922028d1dae5520a95afedd99776dd89
MD5 SHA1 SHA512

Lucifer/cnc/reload.go

SHA256 d980286813d74abf1b818b8042f25537db2ba2283dead8385e280b8132dcad89
MD5 8e1d7d3d1b264001ab8ce362cb3610f3
SHA1 9cea5462b82e700304d06e5e2e2f89523be0d7e7
SHA512 25d224d1a3a05fc4fecba85807ad9dca445012eadd8d7f6c84238569b197fe293700f33011ce929a5a6e1471f0956d0c2dab1d659a383714de4c27827c6bf9c8
MD5 SHA1 SHA512

Lucifer/cnc/shout.go

SHA256 dd0a9517df1ccef071b75e31727b118adb32bee30561f46dfa19ae12f2d41f09
MD5 bddb84d3ca864839f03076a0e579b14f
SHA1 d9364532c1a037e1cd64feb9651a08b68bbb1200
SHA512 591b0f187de65c5d16228f8dedfd05f0c4866501ae79c92c35e1d6c97c728f9201db2b14de24950f975e855b202a0d1bb2a9056e62e2c42632b71daa957595af
SSDEEP 96:yXAXH6x2V57rEDlxJNNWbV/ukuNpQ5dLdscQME:yXl2MHWbVMI7dscDE
MD5 SHA1 SHA512 SSDEEP

Lucifer/cnc/stores.go

SHA256 bb25f7a6ea61b26b2849e82136426ba940fa53548a0840114ad2290f4a9722ac
MD5 2d91f4fbdcaa27bf263993abcd426c53
SHA1 3d14d9bad7dffa2abd1308a7e5875b0a7b26205d
SHA512 1f8301297e6eaa75a111e87da350e64f18a0af70a063ae106fc8d26c7570d47121a8febc8e283518c262a9966ffce05c3e074d9e55355c91bae7bcb1ab247382
MD5 SHA1 SHA512

Lucifer/cnc/struct.go

SHA256 0de52d718edb90c131d9bc701a7938bcf71da724a2b778c7be8deed08c60d83a
MD5 992452484154cbf86fdf1563b7ebc68e
SHA1 f7c456940ce8389386487d3cdc338a12694d4e9b
SHA512 2054f992fa252761072b25bc1859ef3d3d18947198dab86b88e9aabbc7042ea411dbc9afa4e50d9409c1fa3af7d3fab72c525e3487bf1c68f2b44d6218ed0294
MD5 SHA1 SHA512

Lucifer/cnc/terminal.go

SHA256 cc73e12adba3f83b2d474d441d69f448da43041b185dbff0c3726265b30bd58a
MD5 973afecfd479b4bfb7ba8b374249cf1c
SHA1 c161c2bb4e0427461ef60815220deb56a93d235d
SHA512 5083ff331ca015f4ee3f007248d246295fda33bd6e1a806af768ae179bdaff4ad1b513268bb3cf9e2aaf68517b99d9989d0e2784cda592e6ca516f82904d6a1d
SSDEEP 192:kszooBoNYI7gZDooBoNYI7gZDooBoNYI7gZDooBoNYI7gZp35DHb:ksymkmkmkmv35DHb
MD5 SHA1 SHA512 SSDEEP

Lucifer/cnc/totalattacks.go

SHA256 f2def822e340819cb0e8cdb70f1b0edca5456ab3547f87faa31fcb49e94a2ecc
MD5 bb018641cedf0444b5249f3c799d9609
SHA1 012bf4e5ed633a4912395fe02b2ee096bacd33a8
SHA512 42c7cbb63ed13ba29c0e1347ac10fb92608c53a8160aeeb2e34b2b1f33054608a30c857ea85e6d2f06f7c5ae5fb751492e09f53351fb31c7c52fd8c2bcb0a916
MD5 SHA1 SHA512

Lucifer/createdb.md

SHA256 8764c027270c954d48f932b54a36e208aacc627e467ad149c9a7f5ec45d9b369
MD5 251be83d47d564afba05552c3831c182
SHA1 278996f9c7abce3c28a2f08f552d68500b4b0912
SHA512 3f47f7713d84a6b799a4ca9049bf278de5667ba5216731249794c45dac8e955b00464ebe5f75e3dacae8089adf82b31b11e7d60b837c534ebe431a7f279feaf1
SSDEEP 48:Kn6NNbPO8U0LcfhEoDu/s9Y+dviYzQRo0WelyWkSHeetGG0Ef:b3bPO8U0ofhzraWBEf
MD5 SHA1 SHA512 SSDEEP

Lucifer/geobssid

SHA256 344a29daf357f2bc29e76e09ecd0bb933c6d100c415c2d4672a6068e930fd92c
MD5 12a57e5cbd80e24eb8e70758dc7d177a
SHA1 b2115db5ffdc4a5db55fdcf827b2f6947990380c
SHA512 8479a336024f150f5dc8adf492e7965c15637105b2aea53f404c8f81a320f8c7f7f357d7a86e237bb4b0cc7a782c21299ac3163028da4863d48220b8af9be34a
SSDEEP 98304:PlC8y7uxCuy3tNGreU6fX00gSOP4/iWuaqde3EkHb79+G3K0:PlC8iuMuatNGreU6fX00gSVuaH3EKbt
MD5 SHA1 SHA512 SSDEEP

linux x64

Lucifer/iplookup

SHA256 f9324f4eb97ea2c7491a43d184be2a932033fa36bd294e08724893169c9e474a
MD5 4347dafabd6d5cf0f6546d9b266c33a9
SHA1 3d8b755720848dfec8ce2a007d6736c00b915c76
SHA512 d16a6dfebca4b3844082aceb3c35442f40abb71c83ae3e59476b84b11c3fd5b143a51d6b79289956e0c88f362588c316ab4a371090965bc402b10ae68ea3cc5c
SSDEEP 98304:t8PvZxvomqioHzJXk84X0YTUpnjw/iaS7LjMZLa9+opmLJN:t8PxxgmXoHzJXk84X0YTQns04
MD5 SHA1 SHA512 SSDEEP

linux x64

Lucifer/json/apis.json

SHA256 41b0e7d4937c9848422c14a08a1ef6937c7859187e0493bfefc04b04f4df5e17
MD5 66e868399a0e7858d90cb232052716d6
SHA1 2ba559bcb3bcf81d3dd3d6dc7f7053d7fd95e6ef
SHA512 935e521fb41fa56d3b3c4f6d2164e4bf104390b563b4b77bf2cdd5d29db41b5f89f39bca9f4273cbe029f5ec8e3dbc94f88d23545648dd53e5ab1e0a328d1876
SSDEEP 192:YfB7UR6qm7azOHiBcGMW/C5iavR3ysCNbv5J:YfB7UR6qm7azOHiBcGMW/oiavR3ys+bj
MD5 SHA1 SHA512 SSDEEP

Lucifer/json/configure.json

SHA256 8e000a37051c87721f02b6451c6415fc4733579c2f425e1c3153b63045cc7ceb
MD5 0a277e6cfd06fc5c0fe95e5854e1eccb
SHA1 a1e529d1c7b973220a7ee2e831b72548871d6a29
SHA512 ad042a18766fe48a219af77486b27697687b78f6932f6f91611b8a1f01f5d9f56cc8b137a0552876c2f42cc5910bbaa64cb136d39c48e2257445ba9c81300ffd
MD5 SHA1 SHA512

Lucifer/json/funnel.json

SHA256 e7335b376aa5f4f69352176a7772564f079ea69b1b0034a6c85ece4218789642
MD5 4f32fd44306c1a96fc980fa0d6aac90d
SHA1 b27044af6d3e19991f1031f46e1323d8d2ed5a0d
SHA512 1eca6eeba48dd7c91403423d96e9e5cf9472a43240fae3459c81ce81028a9e072eca2772225bc20c42b3d8c97f2bafd09cf3b5d088e1bc73d5b66d4354bc6eec
MD5 SHA1 SHA512

Lucifer/json/prompt.json

SHA256 170836e3411a825348932c203484a6292a1500362c2f61ce72b2f38676d713e4
MD5 e1ce5b8d7011ac5722a1311e3d728a54
SHA1 ce18aadd034973d5581fe53f5d3bad61fb239973
SHA512 ef6e8d9fbd0db491e0f471703dbd445e75d7290d9e7a4233aabe74e6cc4875a815a009540cfbf4edc377aba8ab5a450524fe1e3dd1141f852522543a29b175e3
MD5 SHA1 SHA512

Lucifer/json/title.json

SHA256 fe13d58fda3ba1c6bd7b1f03524a2648bfb2132563a4bd3075d5dfdbb47ad69a
MD5 c5976e30b0fe5db3f9499b714339503b
SHA1 edf8a81e8cd934cf3b866fcabfdf3652d655eb34
SHA512 d0223e45132f83b16546add64043294c1409da29d53e9754b8271a0f3845435da437da35722cef1ccefa7970d5cb5381cbddc8d0ec88659627937db279155063
MD5 SHA1 SHA512

Lucifer/license.key

SHA256 e93cf65e1402115e11b96c292bab73aeda7db1f037af37d697174aef406db7b8
MD5 d38ff0fbf4c819a617bf25507e61a86d
SHA1 88a67f9f3bbf0493eabd9e44f4d6738162212bb4
SHA512 b88ff4df51e85ede9364c293b7c7f02ed99e87b70c0ff75b83574acef7bcece0de79ccaea6914256a968ac99ecc12f5c45ebacd524feb24880e897d77819ca76
MD5 SHA1 SHA512

Lucifer/logs/acclogs.txt

SHA256 64f53537d5c3145ef52852e0e49c31db059af40d28a166cbe2ce699a5d8ba7f9
MD5 cbaadbeabeb329d9ecfce150ef0a3991
SHA1 f5350eb2c43df8b5e1bfae38f5a0914df2226fed
SHA512 41c6b7b6a94728a8e840aa39f556af7c30eeef7499715835c9bdcf46b5814144090d4b43da03ffb30cd9e2d4ae527b807847d92a02dd71cdaf297a79b2ed2758
MD5 SHA1 SHA512

Lucifer/logs/apilogs.txt

SHA256 d605bfa2b7b5eb3385b78f9f5e44c4dfeb5b798ab8408db81ba9c59a4251b451
MD5 09c68079a3aecf08e6b469cf6b746a54
SHA1 2e73c90fe75977d88c874c19595aa1cc2ffc5489
SHA512 ed99e6e2384d61ae5d6184cfbbb215940c834c55b8bd0edd1978baed6e5fa8da0a83f9219e5e7e5df9175766b891dd6929411a0a8cc3e9de44c4dbb21e1319ab
MD5 SHA1 SHA512

Lucifer/logs/commandlogs.txt

SHA256 5faef41b659143ef868e6b89ae0aec83269ab36686cc1ed2e712cf81206a2f0d
MD5 f2bf230875f4fbe6d44b4ff6300a8677
SHA1 c83e56149d41766652ed9dc574aa974e95580a55
SHA512 23b6f1a2c6dd5caa830beacbef39285d099cbc2d8ffd19ec82a9a133a1266dc03974f98e459c964aab2403e67b6804cd16be69dbbcc84bbca4d2a1f7581d0e42
SSDEEP 384:eQ9JiSVd/mVt+BbBBBkkkkbbeee11111///CCCCCUxaVKMF:ea0t4
MD5 SHA1 SHA512 SSDEEP

Lucifer/logs/failedlogins.txt

SHA256 51faa80132de86c04252115936d667e08e837b191dc4e40fef127b308c7514f2
MD5 ae17f66d2c641b80c355a0ec557d1047
SHA1 19930e5d3019f9c97a53e27f87c96f7fcd273369
SHA512 aad47b8aa64be8f469d1ca48c85efe01b588a88b77c566c3734c7c294066b983aa0b0f1a31fefd28565f2324190e2255cc01b52e25b8aeaeaf1e0aeaa2179f11
MD5 SHA1 SHA512

Lucifer/logs/logins.txt

SHA256 a964b2428060a5933983875b61fcd490f68fab3b61ac876fd32eb23afc92fa12
MD5 d3462c848cc0ccfeb63a8f01e39fe43f
SHA1 2532110f0f70cc9d5802810db2a1dd7d06bc11b3
SHA512 5ca533633f7318952f5ef1d9e707222527c2d14602e391dd391d2bc0a04dba0a068904a808bc20f0d432691cd0520f301ca854e7d46cf1c2c8f78dc84281ccad
SSDEEP 96:cZ56hW5Hdgt2G60nkFv8Ryif1kwkxYNfNRZSYcvNxUtepKOckR33D7jJrdjoL+VH:cZ56hW5Hdgt2G60nkFv8Ryif1kwkxYNy
MD5 SHA1 SHA512 SSDEEP

Lucifer/logs/sharingdetction.txt

SHA256 4a16db3006cfd92a1f49b738e246f88de7874fff0c9652e2fdef7b57aff9208d
MD5 0a71e1f18b1767fd421ceb65b75bd182
SHA1 6946a8a3f3ed3fdb3f1f70fcbef45a78c23dfb55
SHA512 7bdd3913495772f8c787e68cab069370481bdb9164476d7a0c5c463e1ae7238835ed0183497ffd46dfe9c8c33d9e281c8ebae699de4bf4777defe10621b720fd
MD5 SHA1 SHA512

Lucifer/nmap

SHA256 17e6235f28332367d640dd8d91359f826b1eaae888b2060e9868f1ba58ac4f67
MD5 3361bf0051cc657ba90b46be53fe5b36
SHA1 bcab5d490feb0e41d4ac2a73f4cd8cf2ff4a9c78
SHA512 e0cf567acd7cf7aa9d6db764e6904b8379631b7b8d5c0e2142246c8e7d7fce2ce0fc47eba81cb482655964d0b194586e04ec681ba18f561506e0b604dac6ba7e
SSDEEP 24576:d+L4+JXMAPxlTgya51wyCjw5DBfcyCnLCcNb0RUo1S9KkRxgFPPPPPPPPV:dscAPngyguwtVcygCcNb0RUo11cgf
MD5 SHA1 SHA512 SSDEEP

linux x64

Lucifer/phonelookup

SHA256 edaf4757ebc67362ecd6f7eb8014995d878d27ec71ba754ec3996891f2e99523
MD5 078d3104c25ef703875a11a59db5a040
SHA1 3c13e1b1aadf8698d2fcdf4d0bab799653627905
SHA512 b18b556657e3724e69056d8afe267c8a5605dffdaecf02946d217dbf690c064b5c599512bf19b578bb570b42094991791aebfcb05b3f6232fa0e8568eeb626a4
SSDEEP 24576:HhG/Tc/2kfCfBB1Cep5+Pojy4C5fErFNRwSNQqby1a4NvTN1zKH:Hh9ukfkpBMxEZkjqby1a4VLzKH
MD5 SHA1 SHA512 SSDEEP

linux x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Lucifer/sumhash

SHA256 06ef9432107b6c0bf59048ccc37f59b1d77fbc96ef2522fc13cc85ba1ebba1b1
MD5 b21ed7e05842ac934940773ae20c0521
SHA1 1a009c081af83d8fb02a190c7bd0a5da9b530eb1
SHA512 294267e14f8e21faac59004a3b518940b684f2414d8a56c16ceb15ecad54661ba404246c8ab517b1d51a40b3be2849403f991ebc88efd7c46a2a4dcbfc1bd759
SSDEEP 49152:W1qKRo2CcWggcWT7tZWIT2Qcd2HYtZ1PXxf:qZo2n2CQS1/Ph
MD5 SHA1 SHA512 SSDEEP

linux x64

Lucifer/titleshit/2fatitle.tfx

SHA256 a3552370277fa43385aebdc1b2c2259451d64e78dd074cf7a352bb5a966c92d3
MD5 c644e92ad71c8c8d63df9570507b81c2
SHA1 619641e89fde28e567e2a51bf111d0b2e644d6f8
SHA512 524b573d15bd9c9088977ab64a8d6ec747bf67be9746f894e10630e1be241827de533f942ecac62baf0f792c2044e4aa3583d4591c783c725794061e86aa1efd
MD5 SHA1 SHA512

Lucifer/titleshit/captchatitle.tfx

SHA256 16bee736390e720688b187a13f91daff35d8c020a1ad5cbe8747448883a65b0b
MD5 dc3e80502a817059cbeab0606df838df
SHA1 7d6264e7d887bbd327e40d3fd255f8d7b4328ffd
SHA512 a38649346c48fea20cbd5e4d90a9a7ae706cb9d62929ddee8d901b1fe2f47e9a149a54a8ee79dd2efbc69717c3cc3a4c27f00008b286418f9d5f8f62bc86f97d
MD5 SHA1 SHA512

Lucifer/titleshit/expiredtitle.tfx

SHA256 b437d2c121347268f56874a64ff03926dc7303958e715f38efe94e4aa43aa926
MD5 f176accd95c63ff88db440682a5e604f
SHA1 f2f20ba26e829530861e341ddc8f480a1f167d49
SHA512 ce6a7713a6e21ce286d4c7b76f82989f2a4bf2e883ab3bef34d6c078e530574bd6daf7661901f532041a938f4b16011e9ecc601c399fcc898beebd26315a38eb
MD5 SHA1 SHA512

Lucifer/titleshit/failedtitle.tfx

SHA256 4b0f5b28628312864a735a4a3beb2c162c34ae0b079e8da7096769309c265bbb
MD5 2f392f2b45e745becd3ef75d309ea031
SHA1 0abbd6f770a85aea9e47b343cb4c26c01b4526d6
SHA512 085d4406b5482ab50579609c5bae1217199994bae08b195a7c151c82360fad94138b0e06457867ee34efd978eba5ba07b1efff77eedf33688c33127b79fd0cdf
MD5 SHA1 SHA512

Lucifer/titleshit/logintitle.tfx

SHA256 b3cf0e6f6d6fbb3282652a8d5981b1dfe6e8a0b53e6edd86cb13322dbfd09045
MD5 7e8b925d00e65e79352afe4c46ba817c
SHA1 2fe42a48eb4b98738681212e25168a4850897597
SHA512 4542817ab8415ded324fa56f4da5162de037aad53422cd8c87701a9948dfd920a379679dede4e2e5b6a4db7999db33343909061262391500b5a6c086c1530e3c
MD5 SHA1 SHA512

Lucifer/whois

SHA256 26dd5a4c522fbb5596f29d60456e7022f53da7dd2ac41ab9c78d0027dd0b5544
MD5 92f7c996557b59c21551abebcf63cd1c
SHA1 e4de48be058ead1f68110d42535382a15cb3951b
SHA512 e4b02a09d799606f1930635af70f595e4cf972e52443676e66beda6eb4e2ce921863bff5f2ef74e452abd622a914b4a20927ba09a71c78f32c46c93224df0c3b
SSDEEP 49152:P9aQvfcrAqAtHXsi4nlggHBiOOfX+ITP5ZforzfM4omMWzT:Po73AtHXsi4neUH1B/
MD5 SHA1 SHA512 SSDEEP

linux x64

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Lucifer_21.zip

Lucifer/app

Lucifer/attacks.json

Lucifer/branding/admin.tfx

Lucifer/branding/banner.tfx

Lucifer/branding/credits.tfx

Lucifer/branding/expiredmsg.tfx

Lucifer/branding/failedusermsg.tfx

Lucifer/branding/help.tfx

Lucifer/branding/hub.tfx

Lucifer/branding/info.tfx

Lucifer/branding/layer7.tfx

Lucifer/branding/loginmsg.tfx

Lucifer/branding/logs.tfx

Lucifer/branding/methods.tfx

Lucifer/branding/msg.tfx

Lucifer/branding/rules.tfx

Lucifer/branding/splash.tfx

Lucifer/branding/tools.tfx

Lucifer/build.sh

Lucifer/cnc.exe

kernel32

generic

Lucifer/cnc/attack.go

Lucifer/cnc/auth.go

Lucifer/cnc/branding.go

Lucifer/cnc/captcha.go

Lucifer/cnc/check.go

Lucifer/cnc/cnc.go

Lucifer/cnc/conf.go

Lucifer/cnc/database.go

Lucifer/cnc/execute.go

Lucifer/cnc/functions.go

Lucifer/cnc/iplookup.go

Lucifer/cnc/main.go

Lucifer/cnc/pass.go

Lucifer/cnc/poly.go

Lucifer/cnc/qrcode.go

Lucifer/cnc/reader.go

Lucifer/cnc/reload.go

Lucifer/cnc/shout.go

Lucifer/cnc/stores.go

Lucifer/cnc/struct.go

Lucifer/cnc/terminal.go

Lucifer/cnc/totalattacks.go

Lucifer/createdb.md

Lucifer/geobssid

Lucifer/iplookup

Lucifer/json/apis.json

Lucifer/json/configure.json

Lucifer/json/funnel.json

Lucifer/json/prompt.json

Lucifer/json/title.json

Lucifer/license.key

Lucifer/logs/acclogs.txt

Lucifer/logs/apilogs.txt

Lucifer/logs/commandlogs.txt

Lucifer/logs/failedlogins.txt

Lucifer/logs/logins.txt

Lucifer/logs/sharingdetction.txt

Lucifer/nmap

Lucifer/phonelookup

Lucifer/sumhash

Lucifer/titleshit/2fatitle.tfx

Lucifer/titleshit/captchatitle.tfx

Lucifer/titleshit/expiredtitle.tfx

Lucifer/titleshit/failedtitle.tfx

Lucifer/titleshit/logintitle.tfx

Lucifer/whois