Overview

overview

10

Static

static

1

9fa0e11feb...dN.exe

windows7-x64

10

9fa0e11feb...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe

  • Size

    846KB

  • Sample

    241129-pvta8awjew

  • MD5

    e3ca517e9b655d1072d7ddd0a08b71b0

  • SHA1

    3bc6c35adf3d135ca63b7b31d9bb309bf0189f9e

  • SHA256

    9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fd

  • SHA512

    ce0b982d7c6643da46d85d15ff45df7a32b9b6c64fc5612e9d2f9664421c8390ab4d42bd33f25f98735ca3539c20931c80d3f28c9e3ee76557a2e42e35806107

  • SSDEEP

    24576:jivDwwT8n0TawwU2hUsUyY8UgNkHN53e/J1XIqfPHhh5/cn5qVppW5NR/ctc0z1p:jivDwwT8n0TawwU2hUsUyY8UgNkHN53q

Score
10/10
luminositydiscoverypersistencerat

Malware Config

Targets

    • Target

      9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fdN.exe

    • Size

      846KB

    • MD5

      e3ca517e9b655d1072d7ddd0a08b71b0

    • SHA1

      3bc6c35adf3d135ca63b7b31d9bb309bf0189f9e

    • SHA256

      9fa0e11feb58183577fefa4268bfff35e336af6e3432154d4618eb9828fd63fd

    • SHA512

      ce0b982d7c6643da46d85d15ff45df7a32b9b6c64fc5612e9d2f9664421c8390ab4d42bd33f25f98735ca3539c20931c80d3f28c9e3ee76557a2e42e35806107

    • SSDEEP

      24576:jivDwwT8n0TawwU2hUsUyY8UgNkHN53e/J1XIqfPHhh5/cn5qVppW5NR/ctc0z1p:jivDwwT8n0TawwU2hUsUyY8UgNkHN53q

    Score
    10/10
    luminositydiscoverypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Luminosity family

      luminosity

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks