Overview

overview

6

Static

static

3

B_W_luminati-cn.exe

windows7-x64

5

B_W_luminati-cn.exe

windows10-2004-x64

6

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

Proxy Manager.exe

windows7-x64

5

Proxy Manager.exe

windows10-2004-x64

5

d3dcompiler_47.dll

windows10-2004-x64

3

ffmpeg.dll

windows7-x64

3

ffmpeg.dll

windows10-2004-x64

3

libEGL.dll

windows7-x64

3

libEGL.dll

windows10-2004-x64

3

libGLESv2.dll

windows7-x64

3

libGLESv2.dll

windows10-2004-x64

3

resources/...-CN.js

windows7-x64

3

resources/...-CN.js

windows10-2004-x64

3

resources/...gen.sh

ubuntu-18.04-amd64

3

resources/...gen.sh

debian-9-armhf

3

resources/...gen.sh

debian-9-mips

3

resources/...gen.sh

debian-9-mipsel

3

resources/...dex.js

ubuntu-18.04-amd64

6

resources/...dex.js

debian-9-armhf

6

resources/...dex.js

debian-9-mips

3

resources/...dex.js

debian-9-mipsel

3

resources/...ade.sh

ubuntu-18.04-amd64

4

resources/...ade.sh

debian-9-armhf

4

resources/...ade.sh

debian-9-mips

3

Analysis

  • max time kernel
    3s
  • max time network
    278s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    28/03/2025, 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app/bin/lpm_downgrade.sh

  • Size

    486B

  • MD5

    c2913650e886be90c3dc3464cf257124

  • SHA1

    5f3a2794a1c3be209f5074d73a6485b48a4e98ba

  • SHA256

    c00ee8c9bf0002b7b3a5cbc7c25f3dd7d2846950826f70a79ed66ad8d180d202

  • SHA512

    e7528a5266b8a1c8fb895656bb6dfea67eb7e094a442e93ab51d3a01f4bf3c48048a729a84a8a0a12223fd021bcf773055115533fe6590850fb4ab0b5aec717d

Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/resources/app/bin/lpm_downgrade.sh
    /tmp/resources/app/bin/lpm_downgrade.sh
    1⤵
      PID:810
    • /usr/local/sbin/bash
      bash /tmp/resources/app/bin/lpm_downgrade.sh
      1⤵
        PID:810
      • /usr/local/bin/bash
        bash /tmp/resources/app/bin/lpm_downgrade.sh
        1⤵
          PID:810
        • /usr/sbin/bash
          bash /tmp/resources/app/bin/lpm_downgrade.sh
          1⤵
            PID:810
          • /usr/bin/bash
            bash /tmp/resources/app/bin/lpm_downgrade.sh
            1⤵
              PID:810
            • /sbin/bash
              bash /tmp/resources/app/bin/lpm_downgrade.sh
              1⤵
                PID:810
              • /bin/bash
                bash /tmp/resources/app/bin/lpm_downgrade.sh
                1⤵
                  PID:810
                  • /usr/bin/dirname
                    dirname /tmp/resources/app/bin/lpm_downgrade.sh
                    2⤵
                      PID:812
                    • /usr/bin/id
                      id -u
                      2⤵
                      • Reads runtime system information
                      PID:816
                    • /bin/date
                      date "+%s000"
                      2⤵
                        PID:818
                      • /bin/uname
                        uname -r
                        2⤵
                          PID:820
                        • /usr/bin/head
                          head -1
                          2⤵
                            PID:825
                          • /usr/bin/head
                            head -80 /dev/urandom
                            2⤵
                              PID:822
                            • /usr/bin/fold
                              fold -w 32
                              2⤵
                                PID:824
                              • /usr/bin/tr
                                tr -dc a-zA-Z0-9
                                2⤵
                                  PID:823
                                • /bin/uname
                                  uname -s
                                  2⤵
                                    PID:827
                                  • /bin/date
                                    date "+%s"
                                    2⤵
                                      PID:829
                                    • /usr/bin/curl
                                      curl -s -X POST "https://perr.lum-lpm.com/client_cgi/perr/?id=lpm_cert.downgrade_no_backup" --data "{\"uuid\": \"09RDXMduC0zip8lb8iu0NKjqLLJO6JpT\", \"timestamp\": \"1743164681\", \"ver\": \"%VER%\", \"info\": {\"platform\": \"linux\", \"c_ts\": \"1743164681\", \"c_up_ts\": \"1743164681000\", \"note\": \"\", \"lum\": 0, \"root\":1, \"os_release\":\"4.9.0-13-4kc-malta\"}}" -H "Content-Type: application/json"
                                      2⤵
                                      • Reads runtime system information
                                      PID:830

                                  Network

                                  MITRE ATT&CK Matrix

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads