Resubmissions

14/01/2025, 16:09

250114-tlvj5ssme110

22/06/2024, 18:05

240622-wphe4axfrd10

General

  • Target
    LunarClient.rar
  • Size 31.3MB
  • Sample240622-wphe4axfrd
  • SHA256 2fba1bde20d6d62699ecf2cc756aba7eb6af7b19262afaa77a0a14519290196c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • xworm

C2
  • 127.0.0.1:33764

  • miles-microphone.gl.at.ply.gg:33764

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 36 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • LunarClient.rar
    .rar 31.3MB
  • LunarClient.exe
    .exe 66KB
  • java/bin/WinFallbackLookup.dll
    .dll 209KB
  • java/bin/awt.dll
    .dll 1.7MB
  • java/bin/dt_socket.dll
    .dll 135KB
  • java/bin/fontmanager.dll
    .dll 775KB
  • java/bin/freetype.dll
    .dll 619KB
  • java/bin/instrument.dll
    .dll 147KB
  • java/bin/j2gss.dll
    .dll 146KB
  • java/bin/j2pcsc.dll
    .dll 95KB
  • java/bin/j2pkcs11.dll
    .dll 175KB
  • java/bin/jaas.dll
    .dll 124KB
  • java/bin/java.dll
    .dll 297KB
  • java/bin/javaaccessbridge.dll
    .dll 274KB
  • java/bin/javajpeg.dll
    .dll 300KB
  • java/bin/jawt.dll
    .dll 91KB
  • java/bin/jdwp.dll
    .dll 362KB
  • java/bin/jimage.dll
    .dll 152KB
  • java/bin/jli.dll
    .dll 246KB
  • java/bin/jsound.dll
    .dll 155KB
  • java/bin/jsvml.dll
    .dll 839KB
  • java/bin/lcms.dll
    .dll 387KB
  • java/bin/management.dll
    .dll 122KB
  • java/bin/management_agent.dll
    .dll 93KB
  • java/bin/management_ext.dll
    .dll 130KB
  • java/bin/mlib_image.dll
    .dll 588KB
  • java/bin/net.dll
    .dll 200KB
  • java/bin/nio.dll
    .dll 148KB
  • java/bin/prefs.dll
    .dll 94KB
  • java/bin/rmi.dll
    .dll 91KB
  • java/bin/server/jvm.dll
    .dll 10.9MB
  • java/bin/splashscreen.dll
    .dll 369KB
  • java/bin/sspi_bridge.dll
    .dll 162KB
  • java/bin/sunmscapi.dll
    .dll 162KB
  • java/bin/w2k_lsa_auth.dll
    .dll 134KB
  • java/bin/windowsaccessbridge-64.dll
    .dll 184KB
  • java/bin/zip.dll
    .dll 154KB
  • java/conf/logging.properties
    2KB
  • java/conf/management/jmxremote.access
    3KB
  • java/conf/management/jmxremote.password.template
    5KB
  • java/conf/management/management.properties
    14KB
  • java/conf/net.properties
    6KB
  • java/conf/security/java.policy
    2KB
  • java/conf/security/java.security
    58KB
  • java/conf/security/policy/README.txt
    2KB
  • java/conf/security/policy/limited/default_US_export.policy
    146B
  • java/conf/security/policy/limited/default_local.policy
    647B
  • java/conf/security/policy/limited/exempt_local.policy
    566B
  • java/conf/security/policy/unlimited/default_US_export.policy
    146B
  • java/conf/security/policy/unlimited/default_local.policy
    193B
  • java/conf/sound.properties
    1KB
  • java/lib/classlist
    72KB
  • java/lib/fontconfig.bfc
    4KB
  • java/lib/fontconfig.properties.src
    12KB
  • java/lib/jfr/default.jfc
    .xml 34KB
  • java/lib/jfr/profile.jfc
    .xml 34KB
  • java/lib/jrt-fs.jar
    .jar 107KB
  • java/lib/jvm.cfg
    29B
  • java/lib/modules
    78.8MB
  • java/lib/psfont.properties.ja
    3KB
  • java/lib/psfontj2d.properties
    11KB
  • java/lib/security/blocked.certs
    2KB
  • java/lib/security/cacerts
    107KB
  • java/lib/security/default.policy
    10KB
  • java/lib/security/public_suffix_list.dat
    .zip 228KB
  • java/lib/tzdb.dat
    104KB
  • java/lib/tzmappings
    21KB

LunarClient.rar

  • SHA256 2fba1bde20d6d62699ecf2cc756aba7eb6af7b19262afaa77a0a14519290196c
  • MD5 SHA1 SHA512 SSDEEP
Password
123