Overview

overview

10

Static

static

3

malware.exe

windows7-x64

10

malware.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_61995f3abfc91cfa855ff4824bc65100
  • Size 157KB
  • Sample250102-aycejstkc1
  • SHA256 0f94ecc5132b9d5f61f4983a36587cb08f58bbf7f3d62b4775da1e892f961f3d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
luminositydiscoverypersistencerat

Malware Config

Targets

    • Target
      malware.exe
    • Size 168KB
    • SHA256 8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverypersistenceluminosityrat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Luminosity family

      luminosity

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks