Overview

overview

7

Static

static

3

luminati-p...up.exe

windows7-x64

4

luminati-p...up.exe

windows10-2004-x64

6

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

Proxy Manager.exe

windows10-2004-x64

6

d3dcompiler_47.dll

windows10-2004-x64

3

ffmpeg.dll

windows10-2004-x64

3

libEGL.dll

windows10-2004-x64

3

libGLESv2.dll

windows10-2004-x64

3

resources/...-CN.js

windows7-x64

3

resources/...-CN.js

windows10-2004-x64

3

resources/...gen.sh

ubuntu-18.04-amd64

3

resources/...gen.sh

debian-9-armhf

3

resources/...gen.sh

debian-9-mips

resources/...gen.sh

debian-9-mipsel

3

resources/...dex.js

ubuntu-18.04-amd64

6

resources/...dex.js

debian-9-armhf

6

resources/...dex.js

debian-9-mips

3

resources/...dex.js

debian-9-mipsel

3

resources/...ade.sh

ubuntu-18.04-amd64

4

resources/...ade.sh

debian-9-armhf

4

resources/...ade.sh

debian-9-mips

1

resources/...ade.sh

debian-9-mipsel

3

resources/...all.sh

ubuntu-18.04-amd64

7

resources/...all.sh

debian-9-armhf

7

resources/...all.sh

debian-9-mips

7

Analysis

  • max time kernel
    148s
  • max time network
    281s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    28/03/2025, 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app/bin/index.js

  • Size

    514B

  • MD5

    2ffac93c1e0896cf98f1514f70fe8637

  • SHA1

    22fa46c684b079fae1a9921a87b3e6c63cc6e373

  • SHA256

    15cb73537b76df1b820056767dae3e8730cd91e1798bbd56e04075e8e677382b

  • SHA512

    cdc66c2d890c8edc558ffac76b46a3e63bb0b8d95e254860f18bca8c03c72fec51133fbcd7e8983219ef0a707614c9f4aed02f640d8d9afa25ff7e1fea00a4f4

Score
6/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 10 IoCs
    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs

    Execution via JavaScript.

    execution
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/resources/app/bin/index.js
    /tmp/resources/app/bin/index.js
    1⤵
      PID:775
    • /usr/local/sbin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:775
    • /usr/local/bin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:775
    • /usr/sbin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:775
    • /usr/bin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Checks CPU configuration
      • Reads CPU attributes
      • Command and Scripting Interpreter: JavaScript
      • Enumerates kernel/hardware configuration
      PID:775
      • /usr/bin/node
        /usr/bin/node "--max-http-header-size=80000" /tmp/resources/app/bin/lum_node.js
        2⤵
        • Creates/modifies environment variables
        • Modifies Bash startup script
        • Checks CPU configuration
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:790
        • /bin/sh
          /bin/sh -c "curl_add_ip(){ if ((\$2)); then PORT=\$2 else PORT=22999 fi ENDPOINT=\"http://127.0.0.1:\$PORT/api/add_whitelist_ip\" DATA=\"ip=\"\$1 curl \$ENDPOINT -X POST -d \$DATA --post301 -L -k }"
          3⤵
            PID:812
          • /bin/sh
            /bin/sh -c "alias lpm_whitelist_ip='curl_add_ip'"
            3⤵
            • Command and Scripting Interpreter: Unix Shell
            • System Network Configuration Discovery
            PID:813
          • /usr/local/sbin/ps
            ps awwxo "pid,comm"
            3⤵
              PID:814
            • /usr/local/bin/ps
              ps awwxo "pid,comm"
              3⤵
                PID:814
              • /usr/sbin/ps
                ps awwxo "pid,comm"
                3⤵
                  PID:814
                • /usr/bin/ps
                  ps awwxo "pid,comm"
                  3⤵
                    PID:814
                  • /sbin/ps
                    ps awwxo "pid,comm"
                    3⤵
                      PID:814
                    • /bin/ps
                      ps awwxo "pid,comm"
                      3⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:814
                    • /usr/local/sbin/ps
                      ps awwxo "pid,args"
                      3⤵
                        PID:815
                      • /usr/local/bin/ps
                        ps awwxo "pid,args"
                        3⤵
                          PID:815
                        • /usr/sbin/ps
                          ps awwxo "pid,args"
                          3⤵
                            PID:815
                          • /usr/bin/ps
                            ps awwxo "pid,args"
                            3⤵
                              PID:815
                            • /sbin/ps
                              ps awwxo "pid,args"
                              3⤵
                                PID:815
                              • /bin/ps
                                ps awwxo "pid,args"
                                3⤵
                                • Reads CPU attributes
                                • Reads runtime system information
                                PID:815
                              • /usr/local/sbin/ps
                                ps awwxo "pid,ppid"
                                3⤵
                                  PID:816
                                • /usr/local/bin/ps
                                  ps awwxo "pid,ppid"
                                  3⤵
                                    PID:816
                                  • /usr/sbin/ps
                                    ps awwxo "pid,ppid"
                                    3⤵
                                      PID:816
                                    • /usr/bin/ps
                                      ps awwxo "pid,ppid"
                                      3⤵
                                        PID:816
                                      • /sbin/ps
                                        ps awwxo "pid,ppid"
                                        3⤵
                                          PID:816
                                        • /bin/ps
                                          ps awwxo "pid,ppid"
                                          3⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:816
                                        • /usr/local/sbin/ps
                                          ps awwxo "pid,uid"
                                          3⤵
                                            PID:817
                                          • /usr/local/bin/ps
                                            ps awwxo "pid,uid"
                                            3⤵
                                              PID:817
                                            • /usr/sbin/ps
                                              ps awwxo "pid,uid"
                                              3⤵
                                                PID:817
                                              • /usr/bin/ps
                                                ps awwxo "pid,uid"
                                                3⤵
                                                  PID:817
                                                • /sbin/ps
                                                  ps awwxo "pid,uid"
                                                  3⤵
                                                    PID:817
                                                  • /bin/ps
                                                    ps awwxo "pid,uid"
                                                    3⤵
                                                    • Reads CPU attributes
                                                    • Reads runtime system information
                                                    PID:817
                                                  • /usr/local/sbin/ps
                                                    ps awwxo "pid,%cpu"
                                                    3⤵
                                                      PID:818
                                                    • /usr/local/bin/ps
                                                      ps awwxo "pid,%cpu"
                                                      3⤵
                                                        PID:818
                                                      • /usr/sbin/ps
                                                        ps awwxo "pid,%cpu"
                                                        3⤵
                                                          PID:818
                                                        • /usr/bin/ps
                                                          ps awwxo "pid,%cpu"
                                                          3⤵
                                                            PID:818
                                                          • /sbin/ps
                                                            ps awwxo "pid,%cpu"
                                                            3⤵
                                                              PID:818
                                                            • /bin/ps
                                                              ps awwxo "pid,%cpu"
                                                              3⤵
                                                              • Reads CPU attributes
                                                              • Reads runtime system information
                                                              PID:818
                                                            • /usr/local/sbin/ps
                                                              ps awwxo "pid,%mem"
                                                              3⤵
                                                                PID:819
                                                              • /usr/local/bin/ps
                                                                ps awwxo "pid,%mem"
                                                                3⤵
                                                                  PID:819
                                                                • /usr/sbin/ps
                                                                  ps awwxo "pid,%mem"
                                                                  3⤵
                                                                    PID:819
                                                                  • /usr/bin/ps
                                                                    ps awwxo "pid,%mem"
                                                                    3⤵
                                                                      PID:819
                                                                    • /sbin/ps
                                                                      ps awwxo "pid,%mem"
                                                                      3⤵
                                                                        PID:819
                                                                      • /bin/ps
                                                                        ps awwxo "pid,%mem"
                                                                        3⤵
                                                                        • Reads CPU attributes
                                                                        • Reads runtime system information
                                                                        PID:819
                                                                      • /usr/bin/node
                                                                        /usr/bin/node "--max-http-header-size=80000" "--max-old-space-size=1024" "--max-http-header-size=80000" /tmp/resources/app/lib/worker.js --dir /root/proxy_manager
                                                                        3⤵
                                                                        • Checks CPU configuration
                                                                        • Reads CPU attributes
                                                                        • Enumerates kernel/hardware configuration
                                                                        PID:820

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Command and Scripting Interpreter

                                                                  2
                                                                  T1059

                                                                  JavaScript

                                                                  1
                                                                  T1059.007

                                                                  Unix Shell

                                                                  1
                                                                  T1059.004

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Defense Evasion

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Virtualization/Sandbox Evasion

                                                                  1
                                                                  T1497

                                                                  System Checks

                                                                  1
                                                                  T1497.001

                                                                  Credential Access

                                                                  Discovery

                                                                  System Information Discovery

                                                                  2
                                                                  T1082

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  Virtualization/Sandbox Evasion

                                                                  1
                                                                  T1497

                                                                  System Checks

                                                                  1
                                                                  T1497.001

                                                                  Lateral Movement

                                                                  Collection

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • /root/proxy_manager/.c97f5f8858accb77216e359a12e13ab16ad55904-audit.json
                                                                    Filesize

                                                                    415B

                                                                    MD5

                                                                    214093e5b3f6b62b375a3d25b7fd5c81

                                                                    SHA1

                                                                    8e923057ec93af40113c65e5dd1b2dd6a4aee0af

                                                                    SHA256

                                                                    7a03ae13f2b31daf01ee5ead7202fed3b105fae3a218ea5b15d6d12735711d09

                                                                    SHA512

                                                                    16036ae1f543516448ceaef5d4fcd8dfea671c2abc0caec71702b2a0aedcb853ceb4edcbb4c86c612d689afc72b3302a5f8cc44c39cff8fd8c36d8533bb47d46

                                                                    Download Submit

                                                                  • /root/proxy_manager/.luminati.uuid
                                                                    Filesize

                                                                    36B

                                                                    MD5

                                                                    c883df830b62c021eb1fd421d44e6037

                                                                    SHA1

                                                                    3dc3dab54c9645ad26a363375bfcc5ed688c529d

                                                                    SHA256

                                                                    731cf8df624fe863294c1741c1af970ecc2c3602be718d701810b49c404dd29a

                                                                    SHA512

                                                                    b59a0fc9e67767af0ef74ad6ef509fee1741e63c6f0ca166c8f53b7a95a461e86ae45529776f1b1fd19397f23d79298518d65725c29a16111319c86462e3292e

                                                                    Download Submit

                                                                  • /root/proxy_manager/carriers.json
                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    1c7b4bc5e90f9d34d9010c875cde2eea

                                                                    SHA1

                                                                    fd3af175f4e48fe104bdd58485a3db98b95237ac

                                                                    SHA256

                                                                    03d7b98ad4b28769d0d5f70bc2911057cd5d8df3680de2c3149ceed557607dc9

                                                                    SHA512

                                                                    8a172b42d8b487d85e2ed2c076e03628032c78e8c24c1e127ac9c5cf71e20ef97d31d621846ce160be87374382e0c472a21af5bbd35c542f87ceab278ccb1ed6

                                                                    Download Submit

                                                                  • /root/proxy_manager/luminati-2025-03-28.log
                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    306d0f06cf985c504165e6e15c00c90f

                                                                    SHA1

                                                                    3390cbe446b4e9169b8be2f3acd0dc45c501a335

                                                                    SHA256

                                                                    ae511709194337bd29b5b5b58ccbc6e2201893af67d6fa707c067653b4448859

                                                                    SHA512

                                                                    1d2b0ac986a3c968c932a1efc55fb8fb84d1d1e6f57e75b716a3ca191b0452e40639d562cf8289d286fb823fa63234daf4065aa63725aeae105448c614a9fd27

                                                                    Download Submit

                                                                  • /root/proxy_manager/vipdb.csv
                                                                    Filesize

                                                                    2.9MB

                                                                    MD5

                                                                    7d527ded0181af6413a4a5350a99b3cf

                                                                    SHA1

                                                                    e51e467fda74901730c7c1cba6cfa8846b212662

                                                                    SHA256

                                                                    73a1059a8db4cc0b05a6c7e980aca23e159ba224939fb6e82070767785233fe2

                                                                    SHA512

                                                                    d81762d6257f4b74b8f96eda6967f1165e1b6fa41aabd04ab42c3ec40c9c9314faba0659a32243740825590776b3c9ee54eeada2378d603b71a71eb643b95b15

                                                                    Download Submit