Overview

overview

6

Static

static

1

MoonlightS....1.exe

windows10-2004-x64

6

MoonlightS....1.exe

windows11-21h2-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MoonlightSetup-5.0.1.exe

  • Size

    53.3MB

  • Sample

    240521-sbg1mahg44

  • MD5

    8066f6f66a7d8b62907dcc7d4c3c8c1f

  • SHA1

    ba8f816439d8cfc2101c4629394c1ca9caf9eec5

  • SHA256

    801d7b8a1640e5ae8f8561c5cbd38e1bd19b42bb9f925646ec71d27255b9196b

  • SHA512

    c47b9dc4c3c4f1bab2424d9910709b9b8107d14014d4539f011d188973156245ecb1ced8b59c432f161e9a14aaa0adcab4288451174107e3fe777bbb0d3ef817

  • SSDEEP

    1572864:Clwsgf4Y37O2JgdkIGVrhlCphLp2P+9Iid+dI:ClF6jO2JguIornCphLp2QR

Score
6/10
discoverypersistence

Malware Config

Targets

    • Target

      MoonlightSetup-5.0.1.exe

    • Size

      53.3MB

    • MD5

      8066f6f66a7d8b62907dcc7d4c3c8c1f

    • SHA1

      ba8f816439d8cfc2101c4629394c1ca9caf9eec5

    • SHA256

      801d7b8a1640e5ae8f8561c5cbd38e1bd19b42bb9f925646ec71d27255b9196b

    • SHA512

      c47b9dc4c3c4f1bab2424d9910709b9b8107d14014d4539f011d188973156245ecb1ced8b59c432f161e9a14aaa0adcab4288451174107e3fe777bbb0d3ef817

    • SSDEEP

      1572864:Clwsgf4Y37O2JgdkIGVrhlCphLp2P+9Iid+dI:ClF6jO2JguIornCphLp2QR

    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks