General
-
Target
Luna v1.1.rar
-
Size
379KB
-
Sample
241230-a5ztesslcm
-
MD5
c68fec91ce7389805c5ce1656886c8f2
-
SHA1
d3c4e004e11e96a78d8469c98c3552fef5de923d
-
SHA256
c4a8a4398c83c1d76db8ea3106de2dfbdd5a7a273db3c0a3ea2dd36c14033f6d
-
SHA512
06269d8d27c039dc9177a5d9dda7fff0627bb7d06cefc78e659febddf5367643c9f9b48f7f65253ff084b1fcef457fd394419d7d55ccd4d4786890a53eee3541
-
SSDEEP
6144:LSh4YV9EoJ6NRzdQCqGPbH/P1tLoKsTw9DbVbeTk/ISbd6xNyEh+D:fYAoJ6NRB/NtLsTobVyToJqUT
Static task
static1
Malware Config
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://tacitglibbr.biz/api
Targets
-
-
Target
Luna v1.1.exe
-
Size
759KB
-
MD5
a8703a974c525efa407ebd34fa64f2ce
-
SHA1
a4e49acc7c6339a05e5e5ab4474136d5f8b448a4
-
SHA256
aaf76b4bba6f51c8124821cbacf7faa925e51cc5f8850fa4b783ae58bb8b9522
-
SHA512
088570a8f5ef7cc14d5b020f915b52c3d6115a5ed27a9b97a3ad7818d2405eaaef5bef025d1eb8c2518e036c168045cbc03b2121ad1da2efe0ec5a2b77dafc2a
-
SSDEEP
12288:amOcxtujR/m8eHAPAHiqsz6GqBfMUyAj1Xwm8eHAPAHiqsz6GqBfMUyAj1Xylr7v:PGNmDH1SbuMYXwmDH1SbuMYXOr7v
-
Lumma family
-
A potential corporate email address has been identified in the URL: [email protected]
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-