Overview

overview

7

Static

static

3

luminati-p...up.exe

windows7-x64

4

luminati-p...up.exe

windows10-2004-x64

6

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

Proxy Manager.exe

windows10-2004-x64

6

d3dcompiler_47.dll

windows10-2004-x64

3

ffmpeg.dll

windows10-2004-x64

3

libEGL.dll

windows10-2004-x64

3

libGLESv2.dll

windows10-2004-x64

3

resources/...-CN.js

windows7-x64

3

resources/...-CN.js

windows10-2004-x64

3

resources/...gen.sh

ubuntu-18.04-amd64

3

resources/...gen.sh

debian-9-armhf

3

resources/...gen.sh

debian-9-mips

resources/...gen.sh

debian-9-mipsel

3

resources/...dex.js

ubuntu-18.04-amd64

6

resources/...dex.js

debian-9-armhf

6

resources/...dex.js

debian-9-mips

3

resources/...dex.js

debian-9-mipsel

3

resources/...ade.sh

ubuntu-18.04-amd64

4

resources/...ade.sh

debian-9-armhf

4

resources/...ade.sh

debian-9-mips

1

resources/...ade.sh

debian-9-mipsel

3

resources/...all.sh

ubuntu-18.04-amd64

7

resources/...all.sh

debian-9-armhf

7

resources/...all.sh

debian-9-mips

7

Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    28/03/2025, 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app/bin/index.js

  • Size

    514B

  • MD5

    2ffac93c1e0896cf98f1514f70fe8637

  • SHA1

    22fa46c684b079fae1a9921a87b3e6c63cc6e373

  • SHA256

    15cb73537b76df1b820056767dae3e8730cd91e1798bbd56e04075e8e677382b

  • SHA512

    cdc66c2d890c8edc558ffac76b46a3e63bb0b8d95e254860f18bca8c03c72fec51133fbcd7e8983219ef0a707614c9f4aed02f640d8d9afa25ff7e1fea00a4f4

Score
6/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 7 IoCs
    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs

    Execution via JavaScript.

    execution
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/resources/app/bin/index.js
    /tmp/resources/app/bin/index.js
    1⤵
      PID:1508
    • /usr/local/sbin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:1508
    • /usr/local/bin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:1508
    • /usr/sbin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:1508
    • /usr/bin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      • Enumerates kernel/hardware configuration
      PID:1508
      • /usr/bin/node
        /usr/bin/node "--max-http-header-size=80000" /tmp/resources/app/bin/lum_node.js
        2⤵
        • Creates/modifies environment variables
        • Modifies Bash startup script
        • Checks CPU configuration
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:1519
        • /bin/sh
          /bin/sh -c "curl_add_ip(){ if ((\$2)); then PORT=\$2 else PORT=22999 fi ENDPOINT=\"http://127.0.0.1:\$PORT/api/add_whitelist_ip\" DATA=\"ip=\"\$1 curl \$ENDPOINT -X POST -d \$DATA --post301 -L -k }"
          3⤵
            PID:1534
          • /bin/sh
            /bin/sh -c "alias lpm_whitelist_ip='curl_add_ip'"
            3⤵
            • Command and Scripting Interpreter: Unix Shell
            • System Network Configuration Discovery
            PID:1535
          • /usr/local/sbin/ps
            ps awwxo "pid,comm"
            3⤵
              PID:1536
            • /usr/local/bin/ps
              ps awwxo "pid,comm"
              3⤵
                PID:1536
              • /usr/sbin/ps
                ps awwxo "pid,comm"
                3⤵
                  PID:1536
                • /usr/bin/ps
                  ps awwxo "pid,comm"
                  3⤵
                    PID:1536
                  • /sbin/ps
                    ps awwxo "pid,comm"
                    3⤵
                      PID:1536
                    • /bin/ps
                      ps awwxo "pid,comm"
                      3⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1536
                    • /usr/local/sbin/ps
                      ps awwxo "pid,args"
                      3⤵
                        PID:1537
                      • /usr/local/bin/ps
                        ps awwxo "pid,args"
                        3⤵
                          PID:1537
                        • /usr/sbin/ps
                          ps awwxo "pid,args"
                          3⤵
                            PID:1537
                          • /usr/bin/ps
                            ps awwxo "pid,args"
                            3⤵
                              PID:1537
                            • /sbin/ps
                              ps awwxo "pid,args"
                              3⤵
                                PID:1537
                              • /bin/ps
                                ps awwxo "pid,args"
                                3⤵
                                • Reads CPU attributes
                                • Reads runtime system information
                                PID:1537
                              • /usr/local/sbin/ps
                                ps awwxo "pid,ppid"
                                3⤵
                                  PID:1538
                                • /usr/local/bin/ps
                                  ps awwxo "pid,ppid"
                                  3⤵
                                    PID:1538
                                  • /usr/sbin/ps
                                    ps awwxo "pid,ppid"
                                    3⤵
                                      PID:1538
                                    • /usr/bin/ps
                                      ps awwxo "pid,ppid"
                                      3⤵
                                        PID:1538
                                      • /sbin/ps
                                        ps awwxo "pid,ppid"
                                        3⤵
                                          PID:1538
                                        • /bin/ps
                                          ps awwxo "pid,ppid"
                                          3⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:1538
                                        • /usr/local/sbin/ps
                                          ps awwxo "pid,uid"
                                          3⤵
                                            PID:1539
                                          • /usr/local/bin/ps
                                            ps awwxo "pid,uid"
                                            3⤵
                                              PID:1539
                                            • /usr/sbin/ps
                                              ps awwxo "pid,uid"
                                              3⤵
                                                PID:1539
                                              • /usr/bin/ps
                                                ps awwxo "pid,uid"
                                                3⤵
                                                  PID:1539
                                                • /sbin/ps
                                                  ps awwxo "pid,uid"
                                                  3⤵
                                                    PID:1539
                                                  • /bin/ps
                                                    ps awwxo "pid,uid"
                                                    3⤵
                                                    • Reads CPU attributes
                                                    • Reads runtime system information
                                                    PID:1539
                                                  • /usr/local/sbin/ps
                                                    ps awwxo "pid,%cpu"
                                                    3⤵
                                                      PID:1540
                                                    • /usr/local/bin/ps
                                                      ps awwxo "pid,%cpu"
                                                      3⤵
                                                        PID:1540
                                                      • /usr/sbin/ps
                                                        ps awwxo "pid,%cpu"
                                                        3⤵
                                                          PID:1540
                                                        • /usr/bin/ps
                                                          ps awwxo "pid,%cpu"
                                                          3⤵
                                                            PID:1540
                                                          • /sbin/ps
                                                            ps awwxo "pid,%cpu"
                                                            3⤵
                                                              PID:1540
                                                            • /bin/ps
                                                              ps awwxo "pid,%cpu"
                                                              3⤵
                                                              • Reads CPU attributes
                                                              • Reads runtime system information
                                                              PID:1540
                                                            • /usr/local/sbin/ps
                                                              ps awwxo "pid,%mem"
                                                              3⤵
                                                                PID:1541
                                                              • /usr/local/bin/ps
                                                                ps awwxo "pid,%mem"
                                                                3⤵
                                                                  PID:1541
                                                                • /usr/sbin/ps
                                                                  ps awwxo "pid,%mem"
                                                                  3⤵
                                                                    PID:1541
                                                                  • /usr/bin/ps
                                                                    ps awwxo "pid,%mem"
                                                                    3⤵
                                                                      PID:1541
                                                                    • /sbin/ps
                                                                      ps awwxo "pid,%mem"
                                                                      3⤵
                                                                        PID:1541
                                                                      • /bin/ps
                                                                        ps awwxo "pid,%mem"
                                                                        3⤵
                                                                        • Reads CPU attributes
                                                                        • Reads runtime system information
                                                                        PID:1541
                                                                      • /usr/bin/node
                                                                        /usr/bin/node "--max-http-header-size=80000" "--max-old-space-size=1024" "--max-http-header-size=80000" /tmp/resources/app/lib/worker.js --dir /root/proxy_manager
                                                                        3⤵
                                                                        • Enumerates kernel/hardware configuration
                                                                        PID:1542

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Command and Scripting Interpreter

                                                                  2
                                                                  T1059

                                                                  JavaScript

                                                                  1
                                                                  T1059.007

                                                                  Unix Shell

                                                                  1
                                                                  T1059.004

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Defense Evasion

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Virtualization/Sandbox Evasion

                                                                  1
                                                                  T1497

                                                                  System Checks

                                                                  1
                                                                  T1497.001

                                                                  Credential Access

                                                                  Discovery

                                                                  System Information Discovery

                                                                  2
                                                                  T1082

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  Virtualization/Sandbox Evasion

                                                                  1
                                                                  T1497

                                                                  System Checks

                                                                  1
                                                                  T1497.001

                                                                  Lateral Movement

                                                                  Collection

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • /root/proxy_manager/.c97f5f8858accb77216e359a12e13ab16ad55904-audit.json
                                                                    Filesize

                                                                    415B

                                                                    MD5

                                                                    e048ec126f3952578e9e79f801eddb21

                                                                    SHA1

                                                                    b355ec320e93c48d075b76c7badbf01479123a7a

                                                                    SHA256

                                                                    db9990ba6bb60b465db8963cfe09e6500d463438b6ccc133bba07f9f8196d9bc

                                                                    SHA512

                                                                    f15aae0785e10ada1a0a0151c8820325f6fb8d7e566395443150edc2255abd310ab84cc95979e10f6de56abdb8cecf466a423c9ff8b88b17c795ec34af872229

                                                                    Download Submit

                                                                  • /root/proxy_manager/.luminati.uuid
                                                                    Filesize

                                                                    36B

                                                                    MD5

                                                                    71a6f18b7fe0e91e69367415d59eca63

                                                                    SHA1

                                                                    6001a95fa0ce752c7a9b796893f796551539fbcb

                                                                    SHA256

                                                                    487d8b6ed90c42c509cb9a03c34380f1d4bdffb0b91bc3bef153dd456eb2c48b

                                                                    SHA512

                                                                    8b33134b5e45534c1991ebd418405dd69f267920784e6a19fbaceb407f7b4ab0768cadedaa465b0749b53d7e578cee70585f6e347751e113c10863f39dab7941

                                                                    Download Submit

                                                                  • /root/proxy_manager/luminati-2025-03-28.log
                                                                    Filesize

                                                                    606B

                                                                    MD5

                                                                    98480d7c011717466d8832d18255f89f

                                                                    SHA1

                                                                    87553a405bccd35b2ec41f9e7d3a804f8e51968b

                                                                    SHA256

                                                                    7eaa0c336177986d4bc71ba05f1a0ee66d1cba5d701e6a213ff0ecd5de9da663

                                                                    SHA512

                                                                    a7109ce4a83837aad6ab83a859da95afa5d727aa76242e65aef113a0a30dbdae02ddb388b4fdb446ebfac17113cc60dc193b4db6a7156de13eb4da6165bff5a6

                                                                    Download Submit