General
- Target x5d448206540275f9746f9c5e9e3d43b31ec37b00aba17201d60e10707669431e.exe
- Size 19.5MB
- Sample260506-xewemscy5j
- SHA256 5d448206540275f9746f9c5e9e3d43b31ec37b00aba17201d60e10707669431e
Score
10/10
Malware Config
Targets
-
- Target x5d448206540275f9746f9c5e9e3d43b31ec37b00aba17201d60e10707669431e.exe
- Size 19.5MB
- SHA256 5d448206540275f9746f9c5e9e3d43b31ec37b00aba17201d60e10707669431e
Score10/10Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
Disables automatic submission of suspicious files to Microsoft by Windows Defender
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
Drops startup file
Loads dropped DLL
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.