Luna-Grabber-main.zip
- SHA256 e1a5ef2777acf33ec21f7dc25bb4b1beec3b6f12752385b1d6d07d8ae917c078
Overview
overview
10Static
static
10Luna-Grabb...er.exe
windows7-x64
7Luna-Grabb...er.exe
windows10-2004-x64
8Luna-Grabb...ion.py
windows7-x64
3Luna-Grabb...ion.py
windows10-2004-x64
3Luna-Grabb...ate.py
windows7-x64
3Luna-Grabb...ate.py
windows10-2004-x64
3Luna-Grabb...upx.py
windows7-x64
3Luna-Grabb...upx.py
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Luna-Grabber-main/Builder.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Luna-Grabber-main/Builder.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral3
Sample
Luna-Grabber-main/tools/obfuscation.py
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Luna-Grabber-main/tools/obfuscation.py
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Luna-Grabber-main/tools/update.py
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
Luna-Grabber-main/tools/update.py
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Luna-Grabber-main/tools/upx.py
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Luna-Grabber-main/tools/upx.py
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Luna-Grabber-main.zip
- Size 7.2MB
- Sample250129-rv1fmsynek
- SHA256 e1a5ef2777acf33ec21f7dc25bb4b1beec3b6f12752385b1d6d07d8ae917c078
- MD5 90a58ab991bc0eb1edd154a31bcda5d2
- SHA1 6de61f5326b5f150a9a4c7eea232e8e87fa70b63
- SHA512 3b9bc29b8c59d0d2eebe09beaa17ab0390a97957b9eeb7322ec253ced901db52ef0d60db0ee5d5f4a45db082b90870fa3b4bab0f22af29696e761d894b9dd595
- SSDEEP 196608:OMVFkE8DSc4eokbV5C5BTDZasMKvjx9B+:OMV2E8D2eokJg5BTDP1F9E
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/)x�)S �.pyc blankgrabber - Blankgrabber family
File Explorer
-
Luna-Grabber-main.zip.zip 7.2MB
-
Luna-Grabber-main/Builder.exe.exe 7.3MB
-
)x�)S �.pyc1KB
-
Luna-Grabber-main/README.md4KB
-
Luna-Grabber-main/gui_images/clipboard.png.png 708B
-
Luna-Grabber-main/gui_images/help.png.png 1KB
-
Luna-Grabber-main/gui_images/home.png.png 873B
-
Luna-Grabber-main/gui_images/luna.ico4KB
-
Luna-Grabber-main/gui_images/luna.png.png 19KB
-
Luna-Grabber-main/requirements.txt160B
-
Luna-Grabber-main/tools/obfuscation.py5KB
-
Luna-Grabber-main/tools/update.py2KB
-
Luna-Grabber-main/tools/upx.py843B
Luna-Grabber-main/Builder.exe
- IMPHASH 20d446c1cb128febd23deb17efb67cf6
- SHA256 7fbbefdae9adf0f81808b9decf48c08ba4a47293e80cd4855c083ab1f392c184
- MD5 a215edd9d9788492b561858e44184bca
- SHA1 77d8816ecce79f525c118687149e2f3b68dcb984
- SHA512 64dfdf28e74a95af3cef3ad89b45d656bb49fba705665aad7878a397f18ae1c1a7e1aca2df466e80179f130b5350f0ac1eea26affe940742c2c42b8930f035ff
- SSDEEP 196608:uuWYS6uOshoKMuIkhVastRL5Di3uq1D7mW:IYShOshouIkPftRL54DRX
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
bc:58:40:5b:48:0e:ae:72:2f:18:25:11:eb:6b:75:86:8c:aa:d3:86:8c:5c:d9:2b:4f:f7:84:fa:85:2f:f7:24
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 29, 2021 - Sep 28, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
2
Major OS version
5
Entry point
49760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetOEMCP
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetEndOfFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=187, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=31935,
count=40, id=261, version=31935,
count=17, id=260, version=31935,
count=9, id=259, version=31935,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32217,
count=1, id=258, version=32217,
)x�)S �.pyc
- SHA256 707c908162b05553a4dace4456b8a359061f42f5cb318292339bfea84d7dff4b
- MD5 678811a6d8ea18b754991c102285d807
- SHA1 a5cc5a9cadb76df14854cd1f1157e34736391eb2
- SHA512 9b039a4cde6e2b4997480b3fe987d54e896f2f709e92c1eeaad6bdcda939dc770b5da36bff59ff88643196cfc51ad291e8b3b2d1e00a5fed578b84d28fd1510b
- MD5 SHA1 SHA512
-
A stealer written in Python and packaged with Pyinstaller
Luna-Grabber-main/README.md
- SHA256 5ed9bf8ea44034f189197b3353b8a0eaa85c05eeb2f9b641c35c9295cabe2595
- MD5 d9e484c060f51dfc8a4d1fcb5d044b94
- SHA1 d197965ec974920fc19ddea81c61e174eef04f62
- SHA512 a74ec8e6d0c291ab5e5df63623ca1e4bfac7cff67aaab743c4d7b9d36dc2b5c6dc2aab3ad369214fa5cd83d57a349520b4a9d6a6c9b89308d5ea2f167055186b
- SSDEEP 96:cIdEekYRkDkKk/NGFXZ2dAvBmVKrtBkCU5vOYNER:cb/I11GBkZ4YxER
- MD5 SHA1 SHA512 SSDEEP
Luna-Grabber-main/gui_images/clipboard.png
- SHA256 73176dfd2addd67c8eec7750f603dcb607d3f3e76458aeb95c0e07cadd5503a8
- MD5 5928442bf2b7571ff23692278c7d3419
- SHA1 38d0d8113d29840b2d744783caabd206af18251e
- SHA512 8c47ae8f0c646851fe6885e12f74e670a99a999dae4fd3316ee2ccb6d891eb1b61099c7d53c2952440bd90bc7863acb37cb606fd77d7ffa4943100d75044dca3
- MD5 SHA1 SHA512
Luna-Grabber-main/gui_images/help.png
- SHA256 2ab20b70d5e052223bbb372dd08e43ad5c25d7949c3633af6267d8da4fd1348c
- MD5 7a13e9fb75eb16d860d32808eb64ff36
- SHA1 d2325b2fc24980477952722c3b9911a7b1a1f539
- SHA512 c12352b77d50c93f04d580291ee81f45f512c214eccae5a5190cf4d94ce2974384f41c0b2c204345886e4169a24cab014a5fbd5dbebfa400bffc396f95a26b1b
- MD5 SHA1 SHA512
Luna-Grabber-main/gui_images/home.png
- SHA256 d6c09209d3b5aa45c99cbf4a26b16ce0230c3d33974a8cba410ba4bfdfb5d1a1
- MD5 0f46864fc6bef1e7fa7d23e9c3644d9c
- SHA1 bbe1a9c732b0ed43b92e0216a0c1eb984462ad6f
- SHA512 ab99ee73f10396ac149d7382686df42fa31d9f22d7ec4d516ee36c11cbf9b8a04f02a71805f4910390571e28bf13d403df25a372d2450acf456de5ce623e6c1f
- MD5 SHA1 SHA512
Luna-Grabber-main/gui_images/luna.ico
- SHA256 ff5332900223c708869afd22c05e982763a4ee6282188314ef36418f760fb843
- MD5 d732d47fbcdd1d247a7460e87063f05b
- SHA1 4607c05583a3a19fe2848a20cd00f2a1d0c7deb5
- SHA512 6b13b99099d13a3ca82843138560add870773a4dc193facf6955be8ec4296b4ff13486f0e8de38b3ad7c625c89b915839836203d131f33185e6f9619b1366d05
- SSDEEP 24:sukRo1sPeK+dEDdyu3rFdnyszO3UcKc4aUZyixi:OUsPeKTxFnDOEcj4r9xi
- MD5 SHA1 SHA512 SSDEEP
Luna-Grabber-main/gui_images/luna.png
- SHA256 f1b1756dc3288794078434c4fda1cd9866eb71cff5d20a717858bf5903baf391
- MD5 81a4f936f4453da3d8613f26e49d2d64
- SHA1 711ef9942259658ba4ac1c289e91fabd9414dd2c
- SHA512 8f505cefc069c644618f01980d927129ec4e637fe158b4f5798800353c10fd1817309d44a96b6a96e9b98788a7c304e4098f7ae7b35342e9acebe5ac4a5dce2b
- SSDEEP 384:a2RkyolgGSaz9xdyi4ztHCUWxMrDpxB//FL12pJinsKlCQMY584d:aObhGJzn41Hnd2PtYT
- MD5 SHA1 SHA512 SSDEEP
Luna-Grabber-main/requirements.txt
- SHA256 ab7f19aedd035cd515579ff8f27ff5108e7cda9c0e976b6a6c40f0637aa9c520
- MD5 c140b4b479ff9a70a1b118ea5b41210d
- SHA1 2ad5293f22b85aec715a5c2ec37bb318829da0f4
- SHA512 8461a30fcf1aac01ec056ec0e2ab812177c502959e0775bcc543a08144e1f761b26da3d200b721a288fdccc7aa8ce00b1a8964aa767a644ee7c05bcb955753bf
- MD5 SHA1 SHA512
Luna-Grabber-main/tools/obfuscation.py
- SHA256 098aed7ba679fd41601bef0a4299565816286aed6e7950f9636790d9d3060d96
- MD5 ee17063bd2e29ac3d56641df002a132e
- SHA1 b3e6e24e97b1a6a4aaac1806f692fd1581455243
- SHA512 04d09e01f1a47dd66fd48fae4f60ba6192084053477a58cf6f60e314dea8798687451528ee867b2490269da632861f369c99a01afac54cf2324062e35cafe375
- SSDEEP 96:nFJelq5XP4oL4dsJPuCLI/5xgJ5onRnGuQXcu:nnXAdsXI/5UoR58cu
- MD5 SHA1 SHA512 SSDEEP
Luna-Grabber-main/tools/update.py
- SHA256 4c68b08ee9ce02e3ab1df65f135fac36712eb8a4f8970988ca12a86ad12aee99
- MD5 986c41243fa69b8b7d641c5c0ae40839
- SHA1 b93d3f895e7244cdd8da96eac869a0002792cb7d
- SHA512 151e5203bf4499379dd7cef959ed30e25926575709fa79b4c451493b8a4b7128ef8ae0a873d9edfaf0fa894d3ea00bb8dbc4b780c25801e8c7c8d7a75a3bd057
- MD5 SHA1 SHA512
Luna-Grabber-main/tools/upx.py
- SHA256 3100e615d0a1bb235e18b30fc2f0974e7fa02d8c9beaf6d0550e35805e2d3edb
- MD5 76efb2a3ae61d0e41f069272fb783cc9
- SHA1 93543bf44215c5bd59d6ece18d435e34c4847598
- SHA512 68f6f2348940408198b28739448a1c0bbc6c541ef9e1226645c78fa6ef469a23efeb11188f51c350a68bdf039d0d62e9b26d3160f9324cf6981585332dfdb7cd
- MD5 SHA1 SHA512