Overview

overview

10

Static

static

5

e0866b5da6...18.exe

windows7-x64

10

e0866b5da6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0866b5da60a9096b7283e02812a17f7_JaffaCakes118

  • Size

    978KB

  • Sample

    241211-jqsagaylbm

  • MD5

    e0866b5da60a9096b7283e02812a17f7

  • SHA1

    68e289646348c0e103bf934f5e788e8641bc1a6f

  • SHA256

    a91e2dd8f993e927d9bcda4f53693e7b84bb1e15f5e744cb6c7de405953460c5

  • SHA512

    682eb7ff0b54ad2793bc0e6b48c78c8d461dcd25d0b4029b3b8ad9ba37fae4be2abe4df009f84acbcfaa3ebc3f4fad39fadc9951642172834a07bae941a023d8

  • SSDEEP

    12288:taWzgMg7v3qnCiMErQohh0F4CCJ8lnyC8rdoH8DV+NmjaQHv+BVNChbddysuYm:saHMv6CorjqnyC8xlDtFP+QvAsuYm

Score
10/10
luminositydiscoverypersistencerat

Malware Config

Targets

    • Target

      e0866b5da60a9096b7283e02812a17f7_JaffaCakes118

    • Size

      978KB

    • MD5

      e0866b5da60a9096b7283e02812a17f7

    • SHA1

      68e289646348c0e103bf934f5e788e8641bc1a6f

    • SHA256

      a91e2dd8f993e927d9bcda4f53693e7b84bb1e15f5e744cb6c7de405953460c5

    • SHA512

      682eb7ff0b54ad2793bc0e6b48c78c8d461dcd25d0b4029b3b8ad9ba37fae4be2abe4df009f84acbcfaa3ebc3f4fad39fadc9951642172834a07bae941a023d8

    • SSDEEP

      12288:taWzgMg7v3qnCiMErQohh0F4CCJ8lnyC8rdoH8DV+NmjaQHv+BVNChbddysuYm:saHMv6CorjqnyC8xlDtFP+QvAsuYm

    Score
    10/10
    luminositydiscoverypersistencerat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Luminosity family

      luminosity

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks