luminosity | df3276923c77fda7e3a581b56bf727686608443c0188b54b23781de64e5102c3 | Triage

Sharing

General

Target

df3276923c77fda7e3a581b56bf727686608443c0188b54b23781de64e5102c3
Size

2.8MB
Sample

241108-frx1kavqcv
MD5

85fd33013e5c7d0c132e37916f6d4d22
SHA1

5b15fc198af5c423859f30a0768e0b6b5c143a44
SHA256

df3276923c77fda7e3a581b56bf727686608443c0188b54b23781de64e5102c3
SHA512

b9e1aa8aaf429f401cc0c87639b59221b104290930b7e3e06c2a74c8a0d56c72809f2cadce518491f405580f83cc7b9816917139c1cccae8daa3a30a4378b0f8
SSDEEP

49152:fsrGlmSlV77N/2zUDwug+TbrgZQly5JJ7nWJSR5BXzzncQPzxwDMuXZ4S:IaN/4UcuXPkcy5jDWWblPVw1Xq

Score

10^/10

luminosity discovery persistence rat

Malware Config

Targets

- Target
  
  df3276923c77fda7e3a581b56bf727686608443c0188b54b23781de64e5102c3
- Size
  
  2.8MB
- MD5
  
  85fd33013e5c7d0c132e37916f6d4d22
- SHA1
  
  5b15fc198af5c423859f30a0768e0b6b5c143a44
- SHA256
  
  df3276923c77fda7e3a581b56bf727686608443c0188b54b23781de64e5102c3
- SHA512
  
  b9e1aa8aaf429f401cc0c87639b59221b104290930b7e3e06c2a74c8a0d56c72809f2cadce518491f405580f83cc7b9816917139c1cccae8daa3a30a4378b0f8
- SSDEEP
  
  49152:fsrGlmSlV77N/2zUDwug+TbrgZQly5JJ7nWJSR5BXzzncQPzxwDMuXZ4S:IaN/4UcuXPkcy5jDWWblPVw1Xq
Score

10^/10

discovery persistence luminosity rat
- Luminosity
  Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
  rat luminosity
- Luminosity family
  luminosity
- Modifies WinLogon for persistence
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

luminositydiscoverypersistencerat