Overview

overview

10

Static

static

3

malware.exe

windows7-x64

10

malware.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_61995f3abfc91cfa855ff4824bc65100

  • Size

    157KB

  • Sample

    250102-aycejstkc1

  • MD5

    61995f3abfc91cfa855ff4824bc65100

  • SHA1

    19acdcf96a78445119001ddd967cf7cc1bd2768f

  • SHA256

    0f94ecc5132b9d5f61f4983a36587cb08f58bbf7f3d62b4775da1e892f961f3d

  • SHA512

    07071c6e6c68f97b7c353e7cc2134a70a38a6385bb6f0d1fad4a35645637b7a1ab5fa6ecbb71c01b6d18fbe090ab8ef23ebc4986a59c0504c966c79d667f2495

  • SSDEEP

    3072:GP/sfddtp/MHjidM8EhXHLmtGAAadiUWil0bL5/yTb5s9z4ZHNNCuNtQMKqMI:GMfPJK8Ew1AWcbLYSdQp+MfB

Score
10/10
luminositydiscoverypersistencerat

Malware Config

Targets

    • Target

      malware.exe

    • Size

      168KB

    • MD5

      aa7814ec18864f0b90a1100a624cb1fd

    • SHA1

      81f5af5bb7b98d4f4901330aadce275cf8529453

    • SHA256

      8f9828956b3a0894dfe5fdd3f0e9ca5919f30f6a9eedb8c52b818808c757f72c

    • SHA512

      7e91a074fe75c9629148a77897afac05433d0e5d99d30683e0c60f58a840002b1c309c5623ab0d862f7b52bdb8be41cd2e0b3ebc14235cad2a65985214a6f288

    • SSDEEP

      3072:bk5zdU9Qy3RDAMx4k3HeSUNz2Pbjc7bN5nzI9CUTjcqyCKGBp2gGrND0GU:w5zd8RDr6zSAqPbjMbnzpWIqvKGtg

    Score
    10/10
    discoverypersistenceluminosityrat

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

      ratluminosity

    • Luminosity family

      luminosity

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks