Overview

overview

6

Static

static

3

B_W_luminati-cn.exe

windows7-x64

5

B_W_luminati-cn.exe

windows10-2004-x64

6

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

Proxy Manager.exe

windows7-x64

5

Proxy Manager.exe

windows10-2004-x64

5

d3dcompiler_47.dll

windows10-2004-x64

3

ffmpeg.dll

windows7-x64

3

ffmpeg.dll

windows10-2004-x64

3

libEGL.dll

windows7-x64

3

libEGL.dll

windows10-2004-x64

3

libGLESv2.dll

windows7-x64

3

libGLESv2.dll

windows10-2004-x64

3

resources/...-CN.js

windows7-x64

3

resources/...-CN.js

windows10-2004-x64

3

resources/...gen.sh

ubuntu-18.04-amd64

3

resources/...gen.sh

debian-9-armhf

3

resources/...gen.sh

debian-9-mips

3

resources/...gen.sh

debian-9-mipsel

3

resources/...dex.js

ubuntu-18.04-amd64

6

resources/...dex.js

debian-9-armhf

6

resources/...dex.js

debian-9-mips

3

resources/...dex.js

debian-9-mipsel

3

resources/...ade.sh

ubuntu-18.04-amd64

4

resources/...ade.sh

debian-9-armhf

4

resources/...ade.sh

debian-9-mips

3

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    28/03/2025, 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app/bin/index.js

  • Size

    514B

  • MD5

    2ffac93c1e0896cf98f1514f70fe8637

  • SHA1

    22fa46c684b079fae1a9921a87b3e6c63cc6e373

  • SHA256

    15cb73537b76df1b820056767dae3e8730cd91e1798bbd56e04075e8e677382b

  • SHA512

    cdc66c2d890c8edc558ffac76b46a3e63bb0b8d95e254860f18bca8c03c72fec51133fbcd7e8983219ef0a707614c9f4aed02f640d8d9afa25ff7e1fea00a4f4

Score
6/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 7 IoCs
    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs

    Execution via JavaScript.

    execution
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/resources/app/bin/index.js
    /tmp/resources/app/bin/index.js
    1⤵
      PID:1504
    • /usr/local/sbin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:1504
    • /usr/local/bin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:1504
    • /usr/sbin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:1504
    • /usr/bin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      • Enumerates kernel/hardware configuration
      PID:1504
      • /usr/bin/node
        /usr/bin/node "--max-http-header-size=80000" /tmp/resources/app/bin/lum_node.js
        2⤵
        • Creates/modifies environment variables
        • Modifies Bash startup script
        • Checks CPU configuration
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:1515
        • /bin/sh
          /bin/sh -c "curl_add_ip(){ if ((\$2)); then PORT=\$2 else PORT=22999 fi ENDPOINT=\"http://127.0.0.1:\$PORT/api/add_whitelist_ip\" DATA=\"ip=\"\$1 curl \$ENDPOINT -X POST -d \$DATA --post301 -L -k }"
          3⤵
            PID:1530
          • /bin/sh
            /bin/sh -c "alias lpm_whitelist_ip='curl_add_ip'"
            3⤵
            • Command and Scripting Interpreter: Unix Shell
            • System Network Configuration Discovery
            PID:1531
          • /usr/local/sbin/ps
            ps awwxo "pid,comm"
            3⤵
              PID:1532
            • /usr/local/bin/ps
              ps awwxo "pid,comm"
              3⤵
                PID:1532
              • /usr/sbin/ps
                ps awwxo "pid,comm"
                3⤵
                  PID:1532
                • /usr/bin/ps
                  ps awwxo "pid,comm"
                  3⤵
                    PID:1532
                  • /sbin/ps
                    ps awwxo "pid,comm"
                    3⤵
                      PID:1532
                    • /bin/ps
                      ps awwxo "pid,comm"
                      3⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1532
                    • /usr/local/sbin/ps
                      ps awwxo "pid,args"
                      3⤵
                        PID:1533
                      • /usr/local/bin/ps
                        ps awwxo "pid,args"
                        3⤵
                          PID:1533
                        • /usr/sbin/ps
                          ps awwxo "pid,args"
                          3⤵
                            PID:1533
                          • /usr/bin/ps
                            ps awwxo "pid,args"
                            3⤵
                              PID:1533
                            • /sbin/ps
                              ps awwxo "pid,args"
                              3⤵
                                PID:1533
                              • /bin/ps
                                ps awwxo "pid,args"
                                3⤵
                                • Reads CPU attributes
                                • Reads runtime system information
                                PID:1533
                              • /usr/local/sbin/ps
                                ps awwxo "pid,ppid"
                                3⤵
                                  PID:1534
                                • /usr/local/bin/ps
                                  ps awwxo "pid,ppid"
                                  3⤵
                                    PID:1534
                                  • /usr/sbin/ps
                                    ps awwxo "pid,ppid"
                                    3⤵
                                      PID:1534
                                    • /usr/bin/ps
                                      ps awwxo "pid,ppid"
                                      3⤵
                                        PID:1534
                                      • /sbin/ps
                                        ps awwxo "pid,ppid"
                                        3⤵
                                          PID:1534
                                        • /bin/ps
                                          ps awwxo "pid,ppid"
                                          3⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:1534
                                        • /usr/local/sbin/ps
                                          ps awwxo "pid,uid"
                                          3⤵
                                            PID:1535
                                          • /usr/local/bin/ps
                                            ps awwxo "pid,uid"
                                            3⤵
                                              PID:1535
                                            • /usr/sbin/ps
                                              ps awwxo "pid,uid"
                                              3⤵
                                                PID:1535
                                              • /usr/bin/ps
                                                ps awwxo "pid,uid"
                                                3⤵
                                                  PID:1535
                                                • /sbin/ps
                                                  ps awwxo "pid,uid"
                                                  3⤵
                                                    PID:1535
                                                  • /bin/ps
                                                    ps awwxo "pid,uid"
                                                    3⤵
                                                    • Reads CPU attributes
                                                    • Reads runtime system information
                                                    PID:1535
                                                  • /usr/local/sbin/ps
                                                    ps awwxo "pid,%cpu"
                                                    3⤵
                                                      PID:1536
                                                    • /usr/local/bin/ps
                                                      ps awwxo "pid,%cpu"
                                                      3⤵
                                                        PID:1536
                                                      • /usr/sbin/ps
                                                        ps awwxo "pid,%cpu"
                                                        3⤵
                                                          PID:1536
                                                        • /usr/bin/ps
                                                          ps awwxo "pid,%cpu"
                                                          3⤵
                                                            PID:1536
                                                          • /sbin/ps
                                                            ps awwxo "pid,%cpu"
                                                            3⤵
                                                              PID:1536
                                                            • /bin/ps
                                                              ps awwxo "pid,%cpu"
                                                              3⤵
                                                              • Reads CPU attributes
                                                              • Reads runtime system information
                                                              PID:1536
                                                            • /usr/local/sbin/ps
                                                              ps awwxo "pid,%mem"
                                                              3⤵
                                                                PID:1537
                                                              • /usr/local/bin/ps
                                                                ps awwxo "pid,%mem"
                                                                3⤵
                                                                  PID:1537
                                                                • /usr/sbin/ps
                                                                  ps awwxo "pid,%mem"
                                                                  3⤵
                                                                    PID:1537
                                                                  • /usr/bin/ps
                                                                    ps awwxo "pid,%mem"
                                                                    3⤵
                                                                      PID:1537
                                                                    • /sbin/ps
                                                                      ps awwxo "pid,%mem"
                                                                      3⤵
                                                                        PID:1537
                                                                      • /bin/ps
                                                                        ps awwxo "pid,%mem"
                                                                        3⤵
                                                                        • Reads CPU attributes
                                                                        • Reads runtime system information
                                                                        PID:1537
                                                                      • /usr/bin/node
                                                                        /usr/bin/node "--max-http-header-size=80000" "--max-old-space-size=1024" "--max-http-header-size=80000" /tmp/resources/app/lib/worker.js --dir /root/proxy_manager
                                                                        3⤵
                                                                        • Enumerates kernel/hardware configuration
                                                                        PID:1538

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Command and Scripting Interpreter

                                                                  2
                                                                  T1059

                                                                  JavaScript

                                                                  1
                                                                  T1059.007

                                                                  Unix Shell

                                                                  1
                                                                  T1059.004

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Defense Evasion

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Virtualization/Sandbox Evasion

                                                                  1
                                                                  T1497

                                                                  System Checks

                                                                  1
                                                                  T1497.001

                                                                  Credential Access

                                                                  Discovery

                                                                  System Information Discovery

                                                                  2
                                                                  T1082

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  Virtualization/Sandbox Evasion

                                                                  1
                                                                  T1497

                                                                  System Checks

                                                                  1
                                                                  T1497.001

                                                                  Lateral Movement

                                                                  Collection

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • /etc/.pm2/module_conf.json
                                                                    Filesize

                                                                    2B

                                                                    MD5

                                                                    99914b932bd37a50b983c5e7c90ae93b

                                                                    SHA1

                                                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                    SHA256

                                                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                    SHA512

                                                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                    Download Submit

                                                                  • /root/proxy_manager/.c97f5f8858accb77216e359a12e13ab16ad55904-audit.json
                                                                    Filesize

                                                                    415B

                                                                    MD5

                                                                    78a970cd22646528b326c1fcd60a742a

                                                                    SHA1

                                                                    c1d479ac754fb985a1204a406887c86fb7953196

                                                                    SHA256

                                                                    cae5fbec574f4215a34aaee3d2af103daefabebf09987c65275408833035107a

                                                                    SHA512

                                                                    e6429c74189d6996bdc24c157119df725d50cca71f2b602840d4872859f863210fd5ddf129f40e78bb7e438fe46b81431561d97cc58c00cb39e964df6ca95617

                                                                    Download Submit

                                                                  • /root/proxy_manager/.luminati.uuid
                                                                    Filesize

                                                                    36B

                                                                    MD5

                                                                    b0452fb154dbf16d4160bfb591c623a6

                                                                    SHA1

                                                                    9d376982d1432892a65afff9461398b7f33614aa

                                                                    SHA256

                                                                    c623df9a980051d85830c43a20219ac7e7cb1c23d04a039a2134753de1f07fba

                                                                    SHA512

                                                                    b739c266dcf03087ca17a7036ddaf394a0bd8dad52ab75ebbe70a5807ce51793bc13c9688dbd35e30eda3b306355de449d9b00744c2d82ac5a35f53ba88ee028

                                                                    Download Submit

                                                                  • /root/proxy_manager/luminati-2025-03-28.log
                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    bd2ee96c4dba0a05b4b257d8204efb9a

                                                                    SHA1

                                                                    3355dad1ed0f65ad5c8abad3a758ca9c19775070

                                                                    SHA256

                                                                    110f43dcbe2d96ee5edcb6a367f3ab4972cd82389bd7a0a19f267193a322f702

                                                                    SHA512

                                                                    d6313617047037b537b02d19244c071fc987eb03b4e1fe976b58abf18666efc9db1898c9dcebaee4b165568dcba9ba344fc897cbbbeea757a3151a9c5b202a89

                                                                    Download Submit