105dab9cc588c50fd42183586076676a20e6c95b8d6b343773aa02e37212a28b | Triage

Sharing

General

Target

luna grabber.exe
Size

22.2MB
Sample

240925-n5cksatfjr
MD5

86e4a3224760af0cf38da82dfc51e10e
SHA1

9a7eeafd2f1863d6258a00728772a8352e89e40e
SHA256

105dab9cc588c50fd42183586076676a20e6c95b8d6b343773aa02e37212a28b
SHA512

e446011e9f05a62e37282d6f0e30f65a1a41fac685657d87fdde879dfcb59eb7fe6450811dcfecbdf88203303a5d69a5412ba06825d0cf5c966a7f0ec5161a92
SSDEEP

393216:UaRIQtsusJWQsUcR4NzK1+TtIiFDCuARuAQhFXmbocDEWY60gMYTfC:rIQtsFYQFS1QtI+CuAgh8xEv3gJT6

Score

8^/10

discovery execution persistence privilege_escalation pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  luna grabber.exe
- Size
  
  22.2MB
- MD5
  
  86e4a3224760af0cf38da82dfc51e10e
- SHA1
  
  9a7eeafd2f1863d6258a00728772a8352e89e40e
- SHA256
  
  105dab9cc588c50fd42183586076676a20e6c95b8d6b343773aa02e37212a28b
- SHA512
  
  e446011e9f05a62e37282d6f0e30f65a1a41fac685657d87fdde879dfcb59eb7fe6450811dcfecbdf88203303a5d69a5412ba06825d0cf5c966a7f0ec5161a92
- SSDEEP
  
  393216:UaRIQtsusJWQsUcR4NzK1+TtIiFDCuARuAQhFXmbocDEWY60gMYTfC:rIQtsFYQFS1QtI+CuAgh8xEv3gJT6
Score

8^/10

discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Information Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionpersistenceprivilege_escalationspywarestealer

behavioral2

discoveryexecutionpersistenceprivilege_escalationspywarestealer