36de78692b60e30070f3664c492ea51e2f81f3e612709f758d3a3ca816174b60

Sharing

Copy URL Twitter E-mail

General

Target
VoidLuneV3 Setup 1.0.0.exe
Size 118.2MB
Sample260515-3tr9esg16w
SHA256 36de78692b60e30070f3664c492ea51e2f81f3e612709f758d3a3ca816174b60
MD5 b8af2c2aba3d8cff96e4c24978da425b
SHA1 4a3a07ca1234571ac216861ec68a55bc44149336
SHA512 ab1778abc408d24f46a491c1fb9ded6d9f2a5c45b2ddcb8fe9fb840f5b63cda7408d07d6c2f792dbe7d59b954aee20294d041e7795c4d1942d142ebd9d6b0ee4
SSDEEP 3145728:YDqk+kFux0VcVKRbT8nYIP3kgRMANlE9zTThBXi:Zk+kMiongbTtBXi
TLSH
T13B4833BFB3329296CC150D30BF71ED4D499D02D3836DEBB6BF1DC1E144B4AAA099605A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  VoidLuneV3 Setup 1.0.0.exe
- Size 118.2MB
- SHA256 36de78692b60e30070f3664c492ea51e2f81f3e612709f758d3a3ca816174b60
- MD5 b8af2c2aba3d8cff96e4c24978da425b
- SHA1 4a3a07ca1234571ac216861ec68a55bc44149336
- SHA512 ab1778abc408d24f46a491c1fb9ded6d9f2a5c45b2ddcb8fe9fb840f5b63cda7408d07d6c2f792dbe7d59b954aee20294d041e7795c4d1942d142ebd9d6b0ee4
- SSDEEP 3145728:YDqk+kFux0VcVKRbT8nYIP3kgRMANlE9zTThBXi:Zk+kMiongbTtBXi
- TLSH
  T13B4833BFB3329296CC150D30BF71ED4D499D02D3836DEBB6BF1DC1E144B4AAA099605A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  VoidLuneV3.exe
- Size 172.6MB
- SHA256 3a8d6eece14e4bde808bb219dfa31308b469e41ee63a2c08e7238734029c90ae
- MD5 bef2472b010e3a761473c9b2a162b673
- SHA1 9bab5e3bcbe44b789dcf46719344d365440d2bb6
- SHA512 e7db0f22d3f2e83270a5b40a267a62d74bb26a77419275834cf3d52f196f983c8ca8a9c17c01ebdde89decfbe9a88b060d50597e684a29c1b32716a9874e8979
- SSDEEP 1572864:I7NR7Rm1DKEM9Lx4vpOzDE0Yyb5IcIZBVAM9gjMdCjWqgXVbRgTsndR0aL/9eO:hVxsOcY7TR79T
- TLSH
  T170889C03E29A40D9E01DD1B58B9B9233EE71B8494B29B6DF275407522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
behavioral9
- Target
  resources/app.asar
- Size 62KB
- SHA256 35e1ce089a273fcc496063fa8ec954729844e6a814c895a794b1cc87c1756c6c
- MD5 26e91641fb67a62645ae7094a265fc85
- SHA1 5c2e5358f2f842acca3c63a0ec2726726a8a6c07
- SHA512 50b92d4741d6a430c14c5125d77abf6e7cb361eaea392d4a7cc1fe49dd8727d7546b019d29593c47b0625df5f3671349d141b982d41dbd7700427d589b5785fe
- SSDEEP 1536:ByQXRr1iXazBTWkvdDEnBrxNpFAzhyV2CPBF:UQXRr1iqz30
- TLSH
  T1B053D7DFB02C5092CF25A2F13B6BE4D94C388905840D2DA75950EBEFA759B46C2B718E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  resources/jvm/bin/WinFallbackLookup.dll
- Size 28KB
- SHA256 46015b9fab8dbf68c74f1794bd2b9abf6d2b866f5b203d5138f8d536449ce06d
- MD5 704c4a7c3b9d3dfbe11359bacadb7732
- SHA1 d427fa0f89858de082cf636dbc3d40c92e5b84b9
- SHA512 de0632692150650d3330e3047cacc4c77371b006efd35c1d734f8b5d2d8a7cc7b8a75f9f56b2ab106a2a1bd422bfc8d5281c1a33c6b0f6b0347244d41a95a65f
- SSDEEP 384:S8ABInfg2UtG2M7U8CA9jg3NyEIYi2mL4/y8RFvIIvZIa7:SDW42aG2uNB9YiDLk5kIv
- TLSH
  T113D20987BD8424C4D87FC070A597262EE9B2B5EA13919BCB67A5881C0B503F53F3C795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  resources/jvm/bin/api-ms-win-core-datetime-l1-1-0.dll
- Size 21KB
- SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
- MD5 8f8eb9cb9e78e3a611bc8acaec4399cb
- SHA1 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
- SHA512 5b10404cdc29e9fc612a0111b0b22f41d78e9a694631f48f186bdde940c477c88f202377e887b05d914108b9be531e6790f8f56e6f03273ab964209d83a60596
- SSDEEP 192:xVIWthWWWEXCVWQ4OWGwvNVAv+cQ0GX01k9z3A1tUG71A5q:xVIWthWJoNbZR9zOtUG7mq
- TLSH
  T1A4A218938AAC8143FCEA2D7012E8DE83BD3D63D71A40916616E4F4582D937C1EB20B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  resources/jvm/bin/jaccesswalker.exe
- Size 69KB
- SHA256 ce742eeedd9302c789756b5954ca88e2fb4decba12676844382607168e6ed380
- MD5 d821df4e894c7f84c4b479ceca430c94
- SHA1 0b35b9579e5d02d30f1adc9e87d8783bad9dbdbc
- SHA512 6c261138053fcb5679fc4fc7e5f5a812cc4b037158489e0b6f1f380ecbeea8f319b814f7f0cc83cc2f3e7143f6965272a19a78563982469b0d4d4ec08e9d889e
- SSDEEP 1536:ABq0VrBcLii9PMunrFfxZZz8I426A3X9EwDaN8FLraC0NLIB5Xwh6kdDES1N1znz:x0VrBcLii9PMunrFfxZZz8I426A3X9Er
- TLSH
  T12763D60F9B6020D5ECF6C0BC68F5911AEA7074A44361E3CBFBE9440A9F66BE07678745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/jvm/bin/rmiregistry.exe
- Size 24KB
- SHA256 74b017bfc1c00124159b37e07cc20da39d37c7e6984dd6f37f342f5e4e6f09cd
- MD5 2e0664abd1d6d6a82f3260ebe8534712
- SHA1 26e36a85fe137ed6129566aa4c0f51b3becfc950
- SHA512 33f6a34db0e60904dabb8afcc98f3c2d76aa2d16fe6f7d20064c10390bef45d737b921769f42772b2001fbc51fe03dbfeddc76b5c28235edee9a06277e7d9b59
- SSDEEP 384:q4jwddYQyFuv5AMNyEIYi2mL4/y8RFvIIvZVFl:q40deFuv5aYiDLk5kIv
- TLSH
  T13CB28E17CE800C96FE5B96B0A8E4671BF9B1B6956ED1C3CB2368C4581F503C03B992DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/jvm/conf/management/jmxremote.password.template
- Size 5KB
- SHA256 0273b6a6b9e20e6ce54c5aee70164028e0395063b2b7d39060a40b6495543dbf
- MD5 ad773cfd53efe03e662f1cf23561f725
- SHA1 3bad5b040b6d7117df4c40609ea0f8074339ee47
- SHA512 e6794168ba80a8ff733d8c1771930ae8c8fc33030e5e9ca02700f326c88a2f68ff09bc734bfd1e492ef15705b288c7918ce1f3f7174742dee6a62dfe086abd65
- SSDEEP 96:MdJb7RT9iQj/y3LNNWoT2Wjb3LpjtzIVSnQDeJuV9uiS2T4Z:059ipz1nlZzIVSnQDeJqpSSO
- TLSH
  T151C1F0126FC52B620B91E354134EA5E5F718916F6E7B0210266CCA2C332BD6641EE8F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $R0/Uninstall VoidLuneV3.exe
- Size 214KB
- SHA256 4ad55d0468230e34ca733c21c8c747bd579363d9d20e8bc148134b29db2f849e
- MD5 865a535721934e436fc8fbcf40d11c9c
- SHA1 0182910ded87f0f1515f24bcf9a31716c07b427f
- SHA512 1d402690eb4bd62a54bd3c3c964d6f199ca3e073270f9d9b86006c03cc6e7dc5feb0f55f9b92f63d54a1819f8b0baa4b6cd995e73949b76ceb3da6b6bf8afa99
- SSDEEP 6144:y740IrSehRIMjdrSE/P84+OPqHts2t0EyL+yab:AxjOd/P84+KqWRKJb
- TLSH
  T141241209B2E0C16BD6F70E3246F2E3F71AB1F51129295B477B80232DB922792ED5D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral25 behavioral26
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31 behavioral32