LunaGrabber | 083921426b059768bdcfc002a0026e386837114fa59b3e8b367158a5cbafa90b | Triage™

Login
Reports

Overview

overview

Static

static

RobloxShad...up.exe

windows7-x64

RobloxShad...up.exe

windows10-2004-x64

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

LICENSES.c...m.html

windows10-2004-x64

RblxShdrSetup.exe

windows7-x64

1

RblxShdrSetup.exe

windows10-2004-x64

6

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...dex.js

windows7-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...pi.dll

windows7-x64

1

resources/...pi.dll

windows10-2004-x64

1

resources/...e3.dll

windows7-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...act.js

windows7-x64

3

resources/...act.js

windows10-2004-x64

3

sqlite-aut...llback

ubuntu-18.04-amd64

1

sqlite-aut...llback

debian-9-armhf

1

sqlite-aut...llback

debian-9-mips

1

Sharing

Copy URL Twitter E-mail

General

Target
RobloxShader_Setup.exe
Size 78.2MB
Sample250107-b89ngayjhz
SHA256 083921426b059768bdcfc002a0026e386837114fa59b3e8b367158a5cbafa90b
MD5 2d0efbfad7d76f3f5a7a3574e1b96ed6
SHA1 e87eb2a5ec34c888abb96ad43428c416c1f2d2aa
SHA512 46ebf222b8308c829495a553031f069de8f7b039beb267f5e7317bb1b260cbf1081efc148965e1a6709d07475a51f6a267328e3a1c4f7cb065ada9a78a4220d4
SSDEEP 1572864:KBe4hdV6xfl/7Hw0ynQ3Y9GF0J2/3M4fvHLTdhK7drGB/:KBe4DoxflTwjI/0A/3/vHLSBrK/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

LunaGrabber redtiger discovery execution linux luna stealer

Static task

static1

5 signatures

stealer luna redtiger LunaGrabber

Behavioral task

behavioral1

Sample

RobloxShader_Setup.exe

Resource

win7-20241023-en

windows7-x64

13 signatures

150 seconds

LunaGrabber redtiger discovery luna stealer

Behavioral task

behavioral2

Sample

RobloxShader_Setup.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

14 signatures

150 seconds

LunaGrabber redtiger discovery luna stealer

Behavioral task

behavioral3

Sample

$PLUGINSDIR/SpiderBanner.dll

Resource

win7-20241023-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/SpiderBanner.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/StdUtils.dll

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/StdUtils.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/WinShell.dll

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/WinShell.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

LICENSES.chromium.html

Resource

win7-20240708-en

windows7-x64

7 signatures

150 seconds

redtiger discovery stealer

Behavioral task

behavioral12

Sample

LICENSES.chromium.html

Resource

win10v2004-20241007-en

windows10-2004-x64

11 signatures

150 seconds

LunaGrabber redtiger discovery luna stealer

Behavioral task

behavioral13

Sample

RblxShdrSetup.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

RblxShdrSetup.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

d3dcompiler_47.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

ffmpeg.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

ffmpeg.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

libEGL.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

libEGL.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

libGLESv2.dll

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

libGLESv2.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

resources/app.asar.unpacked/node_modules/ilovingcats/dist/index.js

Resource

win7-20241023-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

resources/app.asar.unpacked/node_modules/ilovingcats/dist/index.js

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

resources/app.asar.unpacked/node_modules/ilovingcats/prebuilds/win32-x64/node.napi.dll

Resource

win7-20241010-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

resources/app.asar.unpacked/node_modules/ilovingcats/prebuilds/win32-x64/node.napi.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.dll

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js

Resource

win7-20241010-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

sqlite-autoconf-3440200/Makefile.fallback

Resource

ubuntu1804-amd64-20240611-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

sqlite-autoconf-3440200/Makefile.fallback

Resource

debian9-armhf-20240729-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

sqlite-autoconf-3440200/Makefile.fallback

Resource

debian9-mipsbe-20240611-en

debian-9-mips

0 signatures

150 seconds

Malware Config

Targets

- Target
  RobloxShader_Setup.exe
- Size 78.2MB
- SHA256 083921426b059768bdcfc002a0026e386837114fa59b3e8b367158a5cbafa90b
- MD5 2d0efbfad7d76f3f5a7a3574e1b96ed6
- SHA1 e87eb2a5ec34c888abb96ad43428c416c1f2d2aa
- SHA512 46ebf222b8308c829495a553031f069de8f7b039beb267f5e7317bb1b260cbf1081efc148965e1a6709d07475a51f6a267328e3a1c4f7cb065ada9a78a4220d4
- SSDEEP 1572864:KBe4hdV6xfl/7Hw0ynQ3Y9GF0J2/3M4fvHLTdhK7drGB/:KBe4DoxflTwjI/0A/3/vHLSBrK/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

LunaGrabber redtiger discovery luna stealer
- Detects RedTiger Stealer
  stealer
- Lunagrabber family
  LunaGrabber
- Matches Luna Grabber Rule For Entry
  Detects behavior indicative of Luna Grabber malware
  stealer luna
- Redtiger family
  redtiger
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
- MD5 1ca87d8ee3ce9e9682547c4d9c9cb581
- SHA1 d25b5b82c0b225719cc4ee318f776169b7f9af7a
- SHA512 ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
- SSDEEP 24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redtiger discovery stealer LunaGrabber luna
- Detects RedTiger Stealer
  stealer
- Lunagrabber family
  LunaGrabber
- Matches Luna Grabber Rule For Entry
  Detects behavior indicative of Luna Grabber malware
  stealer luna
- Redtiger family
  redtiger
behavioral11 behavioral12
- Target
  RblxShdrSetup.exe
- Size 168.8MB
- SHA256 d4689b304751155717710f5d7ed4e8122b6f814334938ec9f9122d4dfb56b446
- MD5 822a5b921a86b4c9194cf4ee6a574376
- SHA1 8e7373016dc752baa53a3a8e6025b3de3659ead8
- SHA512 5caf372afd5b060ded08e589601f3b289151f7fcbc0fce8d9a6ef47b0aae325c54e13461e21eb3bac6e5d40442d2cdecd4cc1815e3e7cb57abe71f4dcbfc6af8
- SSDEEP 1572864:JOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:tgmeNxNNZxqV
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
- MD5 fa145097e0274da929aacd68c31338ab
- SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
- SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
- SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16 behavioral17
- Target
  libEGL.dll
- Size 467KB
- SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
- MD5 5db499ae909083620e47eeea1623b2af
- SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
- SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
- SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  libGLESv2.dll
- Size 7.4MB
- SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
- MD5 57c23aa2c39f11528e56a48ea1824036
- SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
- SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
- SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/ilovingcats/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/ilovingcats/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size 224B
- SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- MD5 f0a82a6a6043bf87899114337c67df6c
- SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral28 behavioral29
- Target
  sqlite-autoconf-3440200/Makefile.fallback
- Size 547B
- SHA256 67d473327dd92f5cad68fddb78b8bb3e8745aba851147945893e4db5a2b59892
- MD5 8ff4cdbeec29d794549a0aa48da06bc3
- SHA1 7fd897fc720b6c9c6f760867c97a95431fa4693e
- SHA512 9871a654d8b140ad5d6768d385b86ba7f32927f8ed6374e62c93db99be4a40841f6900d648f33d07dc118b6ea93f00c45f53e4b675643b2b487c9c0df1ea1474
- MD5 SHA1 SHA512
Score

1^/10
behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Process Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

stealerlunaredtigerLunaGrabber

behavioral1

LunaGrabberredtigerdiscoverylunastealer

behavioral2

LunaGrabberredtigerdiscoverylunastealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

redtigerdiscoverystealer

behavioral12

LunaGrabberredtigerdiscoverylunastealer

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy