Overview

overview

6

Static

static

3

B_W_luminati-cn.exe

windows7-x64

5

B_W_luminati-cn.exe

windows10-2004-x64

6

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

Proxy Manager.exe

windows7-x64

5

Proxy Manager.exe

windows10-2004-x64

5

d3dcompiler_47.dll

windows10-2004-x64

3

ffmpeg.dll

windows7-x64

3

ffmpeg.dll

windows10-2004-x64

3

libEGL.dll

windows7-x64

3

libEGL.dll

windows10-2004-x64

3

libGLESv2.dll

windows7-x64

3

libGLESv2.dll

windows10-2004-x64

3

resources/...-CN.js

windows7-x64

3

resources/...-CN.js

windows10-2004-x64

3

resources/...gen.sh

ubuntu-18.04-amd64

3

resources/...gen.sh

debian-9-armhf

3

resources/...gen.sh

debian-9-mips

3

resources/...gen.sh

debian-9-mipsel

3

resources/...dex.js

ubuntu-18.04-amd64

6

resources/...dex.js

debian-9-armhf

6

resources/...dex.js

debian-9-mips

3

resources/...dex.js

debian-9-mipsel

3

resources/...ade.sh

ubuntu-18.04-amd64

4

resources/...ade.sh

debian-9-armhf

4

resources/...ade.sh

debian-9-mips

3

Analysis

  • max time kernel
    149s
  • max time network
    292s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    28/03/2025, 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app/bin/index.js

  • Size

    514B

  • MD5

    2ffac93c1e0896cf98f1514f70fe8637

  • SHA1

    22fa46c684b079fae1a9921a87b3e6c63cc6e373

  • SHA256

    15cb73537b76df1b820056767dae3e8730cd91e1798bbd56e04075e8e677382b

  • SHA512

    cdc66c2d890c8edc558ffac76b46a3e63bb0b8d95e254860f18bca8c03c72fec51133fbcd7e8983219ef0a707614c9f4aed02f640d8d9afa25ff7e1fea00a4f4

Score
6/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 10 IoCs
    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs

    Execution via JavaScript.

    execution
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/resources/app/bin/index.js
    /tmp/resources/app/bin/index.js
    1⤵
      PID:779
    • /usr/local/sbin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:779
    • /usr/local/bin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:779
    • /usr/sbin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:779
    • /usr/bin/node
      node /tmp/resources/app/bin/index.js
      1⤵
      • Checks CPU configuration
      • Reads CPU attributes
      • Command and Scripting Interpreter: JavaScript
      • Enumerates kernel/hardware configuration
      PID:779
      • /usr/bin/node
        /usr/bin/node "--max-http-header-size=80000" /tmp/resources/app/bin/lum_node.js
        2⤵
        • Creates/modifies environment variables
        • Modifies Bash startup script
        • Checks CPU configuration
        • Reads CPU attributes
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:790
        • /bin/sh
          /bin/sh -c "curl_add_ip(){ if ((\$2)); then PORT=\$2 else PORT=22999 fi ENDPOINT=\"http://127.0.0.1:\$PORT/api/add_whitelist_ip\" DATA=\"ip=\"\$1 curl \$ENDPOINT -X POST -d \$DATA --post301 -L -k }"
          3⤵
            PID:809
          • /bin/sh
            /bin/sh -c "alias lpm_whitelist_ip='curl_add_ip'"
            3⤵
            • Command and Scripting Interpreter: Unix Shell
            • System Network Configuration Discovery
            PID:810
          • /usr/local/sbin/ps
            ps awwxo "pid,comm"
            3⤵
              PID:811
            • /usr/local/bin/ps
              ps awwxo "pid,comm"
              3⤵
                PID:811
              • /usr/sbin/ps
                ps awwxo "pid,comm"
                3⤵
                  PID:811
                • /usr/bin/ps
                  ps awwxo "pid,comm"
                  3⤵
                    PID:811
                  • /sbin/ps
                    ps awwxo "pid,comm"
                    3⤵
                      PID:811
                    • /bin/ps
                      ps awwxo "pid,comm"
                      3⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:811
                    • /usr/local/sbin/ps
                      ps awwxo "pid,args"
                      3⤵
                        PID:812
                      • /usr/local/bin/ps
                        ps awwxo "pid,args"
                        3⤵
                          PID:812
                        • /usr/sbin/ps
                          ps awwxo "pid,args"
                          3⤵
                            PID:812
                          • /usr/bin/ps
                            ps awwxo "pid,args"
                            3⤵
                              PID:812
                            • /sbin/ps
                              ps awwxo "pid,args"
                              3⤵
                                PID:812
                              • /bin/ps
                                ps awwxo "pid,args"
                                3⤵
                                • Reads CPU attributes
                                • Reads runtime system information
                                PID:812
                              • /usr/local/sbin/ps
                                ps awwxo "pid,ppid"
                                3⤵
                                  PID:813
                                • /usr/local/bin/ps
                                  ps awwxo "pid,ppid"
                                  3⤵
                                    PID:813
                                  • /usr/sbin/ps
                                    ps awwxo "pid,ppid"
                                    3⤵
                                      PID:813
                                    • /usr/bin/ps
                                      ps awwxo "pid,ppid"
                                      3⤵
                                        PID:813
                                      • /sbin/ps
                                        ps awwxo "pid,ppid"
                                        3⤵
                                          PID:813
                                        • /bin/ps
                                          ps awwxo "pid,ppid"
                                          3⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:813
                                        • /usr/local/sbin/ps
                                          ps awwxo "pid,uid"
                                          3⤵
                                            PID:814
                                          • /usr/local/bin/ps
                                            ps awwxo "pid,uid"
                                            3⤵
                                              PID:814
                                            • /usr/sbin/ps
                                              ps awwxo "pid,uid"
                                              3⤵
                                                PID:814
                                              • /usr/bin/ps
                                                ps awwxo "pid,uid"
                                                3⤵
                                                  PID:814
                                                • /sbin/ps
                                                  ps awwxo "pid,uid"
                                                  3⤵
                                                    PID:814
                                                  • /bin/ps
                                                    ps awwxo "pid,uid"
                                                    3⤵
                                                    • Reads CPU attributes
                                                    • Reads runtime system information
                                                    PID:814
                                                  • /usr/local/sbin/ps
                                                    ps awwxo "pid,%cpu"
                                                    3⤵
                                                      PID:815
                                                    • /usr/local/bin/ps
                                                      ps awwxo "pid,%cpu"
                                                      3⤵
                                                        PID:815
                                                      • /usr/sbin/ps
                                                        ps awwxo "pid,%cpu"
                                                        3⤵
                                                          PID:815
                                                        • /usr/bin/ps
                                                          ps awwxo "pid,%cpu"
                                                          3⤵
                                                            PID:815
                                                          • /sbin/ps
                                                            ps awwxo "pid,%cpu"
                                                            3⤵
                                                              PID:815
                                                            • /bin/ps
                                                              ps awwxo "pid,%cpu"
                                                              3⤵
                                                              • Reads CPU attributes
                                                              • Reads runtime system information
                                                              PID:815
                                                            • /usr/local/sbin/ps
                                                              ps awwxo "pid,%mem"
                                                              3⤵
                                                                PID:816
                                                              • /usr/local/bin/ps
                                                                ps awwxo "pid,%mem"
                                                                3⤵
                                                                  PID:816
                                                                • /usr/sbin/ps
                                                                  ps awwxo "pid,%mem"
                                                                  3⤵
                                                                    PID:816
                                                                  • /usr/bin/ps
                                                                    ps awwxo "pid,%mem"
                                                                    3⤵
                                                                      PID:816
                                                                    • /sbin/ps
                                                                      ps awwxo "pid,%mem"
                                                                      3⤵
                                                                        PID:816
                                                                      • /bin/ps
                                                                        ps awwxo "pid,%mem"
                                                                        3⤵
                                                                        • Reads CPU attributes
                                                                        • Reads runtime system information
                                                                        PID:816
                                                                      • /usr/bin/node
                                                                        /usr/bin/node "--max-http-header-size=80000" "--max-old-space-size=1024" "--max-http-header-size=80000" /tmp/resources/app/lib/worker.js --dir /root/proxy_manager
                                                                        3⤵
                                                                        • Checks CPU configuration
                                                                        • Reads CPU attributes
                                                                        • Enumerates kernel/hardware configuration
                                                                        • Reads runtime system information
                                                                        PID:817

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Command and Scripting Interpreter

                                                                  2
                                                                  T1059

                                                                  JavaScript

                                                                  1
                                                                  T1059.007

                                                                  Unix Shell

                                                                  1
                                                                  T1059.004

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Defense Evasion

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Virtualization/Sandbox Evasion

                                                                  1
                                                                  T1497

                                                                  System Checks

                                                                  1
                                                                  T1497.001

                                                                  Credential Access

                                                                  Discovery

                                                                  System Information Discovery

                                                                  2
                                                                  T1082

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  Virtualization/Sandbox Evasion

                                                                  1
                                                                  T1497

                                                                  System Checks

                                                                  1
                                                                  T1497.001

                                                                  Lateral Movement

                                                                  Collection

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • /etc/.pm2/module_conf.json
                                                                    Filesize

                                                                    2B

                                                                    MD5

                                                                    99914b932bd37a50b983c5e7c90ae93b

                                                                    SHA1

                                                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                    SHA256

                                                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                    SHA512

                                                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                    Download Submit

                                                                  • /root/proxy_manager/.c97f5f8858accb77216e359a12e13ab16ad55904-audit.json
                                                                    Filesize

                                                                    415B

                                                                    MD5

                                                                    f2efefe906bcb1c767e5744ff916ae13

                                                                    SHA1

                                                                    2e4fc7b8c6a6ff1a0081517589b3b42314d76e55

                                                                    SHA256

                                                                    71a86f203ceff8524588f4eafd3283b7c77eb5e341f6f624e8db6adfc54ab665

                                                                    SHA512

                                                                    fd053d2a69b20361fd49482ee8d6ac64d4cae92515874435270c62141a11ed871c233bda8e528ba39166e2c3fc091f339bdde5016509f171770dd7714cafb987

                                                                    Download Submit

                                                                  • /root/proxy_manager/.luminati.uuid
                                                                    Filesize

                                                                    36B

                                                                    MD5

                                                                    0bb60bce9609b70c5e02dca122073794

                                                                    SHA1

                                                                    49ed0adc8fe3dd138f1f8e218c38fde5aa08b094

                                                                    SHA256

                                                                    894e491a42287764653e93f24203541272dfd150524465732c34f2c667030d5e

                                                                    SHA512

                                                                    a339863831cf5e881d86330d7e59613c50cba00007db5f6156f34dddc9bb82bba38db6b0a5e4011e08df617125a4ec2824aa469fc363a08f68b19352212a9e84

                                                                    Download Submit

                                                                  • /root/proxy_manager/carriers.json
                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    1c7b4bc5e90f9d34d9010c875cde2eea

                                                                    SHA1

                                                                    fd3af175f4e48fe104bdd58485a3db98b95237ac

                                                                    SHA256

                                                                    03d7b98ad4b28769d0d5f70bc2911057cd5d8df3680de2c3149ceed557607dc9

                                                                    SHA512

                                                                    8a172b42d8b487d85e2ed2c076e03628032c78e8c24c1e127ac9c5cf71e20ef97d31d621846ce160be87374382e0c472a21af5bbd35c542f87ceab278ccb1ed6

                                                                    Download Submit

                                                                  • /root/proxy_manager/luminati-2025-03-28.log
                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    bf0f61a9892e44ebe77fcac4329d4e1a

                                                                    SHA1

                                                                    f643ece4b787519ad01d8ffef7770c45beae6584

                                                                    SHA256

                                                                    83a6745c0efea47387b9ac7a4a6fc9afa33b5b882cdca5563d0a9cc56de24ece

                                                                    SHA512

                                                                    93376e2a4619bb610beb472f0402a42eac7418af0323b6881c103b11d7fbe4830c508a0d439c1537c7f643eb853571f509b1cd2997d308e4d2f02d557e8182f0

                                                                    Download Submit

                                                                  • /root/proxy_manager/vipdb.csv
                                                                    Filesize

                                                                    2.9MB

                                                                    MD5

                                                                    7d527ded0181af6413a4a5350a99b3cf

                                                                    SHA1

                                                                    e51e467fda74901730c7c1cba6cfa8846b212662

                                                                    SHA256

                                                                    73a1059a8db4cc0b05a6c7e980aca23e159ba224939fb6e82070767785233fe2

                                                                    SHA512

                                                                    d81762d6257f4b74b8f96eda6967f1165e1b6fa41aabd04ab42c3ec40c9c9314faba0659a32243740825590776b3c9ee54eeada2378d603b71a71eb643b95b15

                                                                    Download Submit