1c9ac4314ce66d11b9364c67ca0444d2dc5fc7e1b3f67ea75725f3a10ef020cb

Sharing

Copy URL Twitter E-mail

General

Target
luatoolsinstaller.exe
Size 3.8MB
Sample260620-tgps4afy4m
SHA256 1c9ac4314ce66d11b9364c67ca0444d2dc5fc7e1b3f67ea75725f3a10ef020cb
MD5 09cd04edb1a2c48f1a0ad172bfec8370
SHA1 253d38dd0c68b68b70e3df98911584077f790017
SHA512 68323f65411a967d4d3d44f721c99c953e6d55fa513b81d42fa186492fba9c54b06f1f649bfc73c3f9594da1d9ef776fada31e839703c129c51d01062b3d7f6f
SSDEEP 98304:+RTR5Gz1aKHy0pxuwVDl241V9QLZn234MIscUz7rIaebALUjdw24tFC6j:+Vqz0opll241VSFnG4WjzXM+KdYtFJ
TLSH
T15906233351E361A4E8C07CB866282455938D9E3129AFB3777403FE9FD5FB2918318D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  luatoolsinstaller.exe
- Size 3.8MB
- SHA256 1c9ac4314ce66d11b9364c67ca0444d2dc5fc7e1b3f67ea75725f3a10ef020cb
- MD5 09cd04edb1a2c48f1a0ad172bfec8370
- SHA1 253d38dd0c68b68b70e3df98911584077f790017
- SHA512 68323f65411a967d4d3d44f721c99c953e6d55fa513b81d42fa186492fba9c54b06f1f649bfc73c3f9594da1d9ef776fada31e839703c129c51d01062b3d7f6f
- SSDEEP 98304:+RTR5Gz1aKHy0pxuwVDl241V9QLZn234MIscUz7rIaebALUjdw24tFC6j:+Vqz0opll241VSFnG4WjzXM+KdYtFJ
- TLSH
  T15906233351E361A4E8C07CB866282455938D9E3129AFB3777403FE9FD5FB2918318D9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  cloud_redirect.dll
- Size 1.3MB
- SHA256 016af0441da4a26f89cfeb5c8bea9bea549669cc6b11880be59b291755db690f
- MD5 7eccab79fd158b50b124f075ee3b9aa8
- SHA1 a6b57ad535cc3bc2f6f2a573b0e5a821fb06af52
- SHA512 c3d65424023af91e4c1e6815803829ccc5a196e1c1cd0125a5ef8babc785d8ccf89ee8634f5c425897e623e6ee87be07413f1db91eae1a893e327ed9b5845f44
- SSDEEP 24576:zctZLL9Mc79PxpPx0zM0IYiB0KtNOKqRj4HQzqnfHW:zcDLL/hPxxxuMxY4DNOKkDenvW
- TLSH
  T1D7554B275388017CE1B6C1BDCF9A9D43E772740A0371A9EF07E085A26E676E45F3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  cloudredirect.ps1
- Size 206B
- SHA256 aaf0c5bc907d89177de53e6042a507c1b25d880333dd6931808bb009e9ecaa63
- MD5 ea552029cb7979eb07e924bc6e4ee65b
- SHA1 7ae033c8c9f43af551fc01e7f410eafd6aa78a11
- SHA512 2f9c87362145f58047669e10f283bd0a01df31b36160ab44b6ef997afde327102999994b2458d561e2ee700aff50974672c42a5b860f13240f92cbabf919865f
- TLSH
  T116D01267ABE1B17CD978708AED875357B183984DC50E85FC1D597616C81219201DD04B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
behavioral5 behavioral6
- Target
  dwmapi.dll
- Size 132KB
- SHA256 1ce49ed63af004ad37a4d2921a5659a17001c4c0026d6245fcc0d543e9c265d0
- MD5 6ef1dc91e464e6facd41abe889e52894
- SHA1 bb080347344da6898a50a8422a2fbcb78c21aadb
- SHA512 5e97c90cbcc1e308203e3513f450f4f77783bb274a0d2c51297971972e8c99e95b578b300b7a0e111279dcc0ce95be38c36ebf662c48033b337bc2d606caf90c
- SSDEEP 3072:9l2eG723XIIc+y8FsVgqdTOCr0bhzsisAUqiXwpJUP:X2eGYYy2BOCYHynAz2
- TLSH
  T132D38D5BB7E510BBE5678A39C4834A45D772B8510BA0EBEF03B442561F233E15E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  millennium/bin/millennium.crashhandler64.exe
- Size 647KB
- SHA256 6cd3b1ccf19072b5ccfa77b4fb6cd452cec46c43b52eb41dfeeaff6b1451457f
- MD5 661c8d4d8ca97f4c515c93c8c9910a3c
- SHA1 35ba80e3e5d65bb593d46f75a7f233e7f6405b94
- SHA512 d5504f32ac4be6cec8ca7b80e2b50f16873040615661270840659683d227e342f72ea1fafd6f3ee2a4d4cf6efdfe011f9273fa6c72f1c3209bd7b49ba713dfde
- SSDEEP 6144:s2C6CiUF3UxthYzsG89dme4bsZCm4RzC7LYGVGIXEEaLKtPJyuy3FJIfDZWgeixD:sf3UT2C4b2Cm4RuYFIXEDKtoNFJ6SY
- TLSH
  T166E48D16B3D402F9E067D27AC9968A66FAB2B8061734A7C703E446552F277E14F3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  millennium/bin/millennium.luavm64.exe
- Size 2.5MB
- SHA256 5f887e74812c3a89be1da5c199b05cea115b1cadb8e5055bc9aad898d11d9329
- MD5 576b3ec8ecc5eb361a653a966323040a
- SHA1 be94ba90c423fb22af1309a57e992bea5e441744
- SHA512 ebb9de9c83135f260cae05d551ded07f1b80ef6e36bd824de1e12f4d8e959932f5c170b5c5ef044b4ed1839c16e5e905e2534d019e4e385fe6dd05079ea63431
- SSDEEP 49152:n1WAaKR+vCHe5x653grGsjh70YU4fzfkg88aD98I:WQ+agrGsjtnDfIh
- TLSH
  T1C7C59F1A666801ECD177C1BCCA968A47F7B27809033196DF03E55BAA2F67AE1077F311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  millennium/lib/millennium.dll
- Size 3.5MB
- SHA256 edf6b6020094722cdca668624e20bf3a605c28f61a4eecb9b07826e5d268ae3a
- MD5 22ae13d5fbab2f5371d07592fcfe1cb4
- SHA1 28138e2668f36bd86a82f2af0449d5f2121f9814
- SHA512 994432dc209f1d0bd80e6104c5fa9a2f08936964d923fc39030176764529d690eb99c6229e818e8c1cba9f20a4a16d7ad367e4799f7155101d7a7b78085a7c44
- SSDEEP 49152:KeqszyXH5mzW9Wp8FJWakLBpC8W2l5Bd0G0vgWguob7BG6VPq5AogcXMftInbP/6:KeuNPsTLAqBd0G0vgWguJ/r12jpw
- TLSH
  T19E06BF1677A410B9C1AAC2F4C95B4903F7727449533191EF63A889A72FA37A0927FF34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  millennium/lib/millennium.hhx64.dll
- Size 505KB
- SHA256 6b6149faa14f23ae2a008d33899179e76b1d94b8afe121463ac7c6c204f67e64
- MD5 16236ce534d38f1177cda0a1a436c97e
- SHA1 fc0cb9780e54155f97662467f0ca4ffc812ca546
- SHA512 b1cb52d643e8200f2ce1748fad8b85f1481369a0c643dabf078026d75b23cd221ef3db71635c9372a03c884930f223ff0943c19b9d81f648fa09f39940397e89
- SSDEEP 6144:aGUEkHI3xryoBXDtLG4zXNrtqxOJtDc1ygFrfYxOXfxoKqCYqoq3jDbnPz5QF:a/EkohOoBz9V+yw0YPxX4CjbiF
- TLSH
  T137B4AE15B6A90379E1ABC178C9A34A03E7B2F8464760E6DF13D045BB1F23BE05A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  millennium/plugins/ltsteamplugin/.millennium/Dist/index.js
- Size 8KB
- SHA256 0c86e9362f6eaed7eeaa183ca818a6f389824ab1f249a5f47f15dd3238d75dba
- MD5 8c37ea5bb1eedbba5c26b2560b24773b
- SHA1 550d8121aa9cfc885d81a551601327e2bcfa85ff
- SHA512 0b4a022347e3abf4de96d80ef3d18bf5b71ed7c5714654b042c7c1cf7d95baabeabc7372fc2d27927265e35f699594bf4ec6adc498a9b0f42a1de8c9863a9e3f
- SSDEEP 192:5F7bSyMWvXAtgiElAMN1yFkdD66JSjfqfYsBw1zuYK0bhPC41yc2dBXKbdf0QdPX:QgiCAMPC2ESIy5DRWEVS
- TLSH
  T1620295083DE712264577B378BEAF61C1B63C470B41B5D860BEEC4214DF8286687A6BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  millennium/plugins/ltsteamplugin/.millennium/Dist/webkit.js
- Size 21KB
- SHA256 5d2db00ba73c9503b707679ccb9167af4b859c83181471e973f537a678ad9102
- MD5 2f3c8bd381d6be8fa7b7e58dcfc24eb4
- SHA1 f4497007c0b3a4a5b9940ecae8cb83c9f0ff30cb
- SHA512 ce3570ee57841e88eadb9dbdf8888e4372760d2cd11f8801591c3df941ba0ca032576b38fac42dfd55083f9f7abd000d5e0ffca6f4cee9b10293f5f046abcad4
- SSDEEP 384:2giCAMPC2ESIy5DMejHOGY3H4OUWSgL9dEol4lk0CZ27IoIOr3n7PdF1WEVS:2giCAMPRIsDMKHOGY3H4OUPgL9dEolLr
- TLSH
  T1EAA2E8393CD81236027362ED75BBB185B6650F0F7418C080B69C9D54EFB5E928AABF5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  millennium/plugins/ltsteamplugin/backend/api_manifest.lua
- Size 12KB
- SHA256 5c3eb6af56381720814599a52f5acf54793d647846b87aaadd6e358a1730faa9
- MD5 8294d0c1ab2c947cb8acb409287f9b5f
- SHA1 00a52218cdc710c1cfe65736950dbaa156c9b8e8
- SHA512 f4326fd92d91a08926cf9424717255305ba704382ff5e70984b6e4f6ee1c420446492cfe562e38eff456b3fb7b5911d2ba8ec73ccbce5909c8610e88c151ad12
- SSDEEP 192:8/bsvdvgZ8rDN1uH91egadC3CRNlBcKkFjzsAqfy9X2CWZlA:8wltXNmd0QYA
- TLSH
  T1A942440B768F94AD88F28A56D9474641F616C4C31B170231BEACA1E83FF057D61F5BAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  millennium/plugins/ltsteamplugin/backend/donate_keys.lua
- Size 6KB
- SHA256 085c67121538a6aaffe27a3dd5b8ff48f183baee1bf8367d72d589146107dc5a
- MD5 650d813cb388999aec18e3064987a32d
- SHA1 773284c551ccf1e22fa3f6d1dab7e9d4fe1d79ec
- SHA512 0e0957dc74b5ef386ef883bd745fd0cac2375a542909284ee16cac496470c17f8f53205164a339074f60246d5108227f8068cb02cb9b0ce7bc1e02449209acec
- SSDEEP 192:J74C/1CyOWyTq8o4t4TNPtsVSn/JMXe7P:J743yOJqA4TVtsIhL
- TLSH
  T1B0D12F2779C36560AEF2DAD9CC4BA812F731A01322591129765E45B03FB067CC2F6B7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  millennium/plugins/ltsteamplugin/backend/downloads.lua
- Size 13KB
- SHA256 34e13612982c6b3d0df56e1851542d145b28e1c36bdc92a564f76e16e932fd27
- MD5 a00e0f6563ba6e02ce7a2eb671041e17
- SHA1 e39e8bf3f0ce5d800b0417ab071df2dd53fb73a4
- SHA512 e9e417a6f2c21989f9d1aba68201b2c9bf56b84023269b4878e70466bd5bcdd9754a1af322c628f3668b6e525f93369f9cbaf3ea58e1bc7701fcc5990dc1757f
- SSDEEP 192:fcVoQInsYJcvOBRV2olYNiadxiZVJ1X7Ex9tiadarRhRlJ/VUHk7Xz0c:fcV+ns6FliiaEQ9tiaIAdc
- TLSH
  T13752A50B12C39A569DF2C6C9DD8B5912F692858316170435BEBC06D43FB02ACD2FA77E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  millennium/plugins/ltsteamplugin/backend/restart_steam.cmd
- Size 532B
- SHA256 0b17eeec8d2e0e72c5a896a1d9558ac06928e3e2edcf7af23428afe571aa790e
- MD5 21b7509230737e6d588e450c1056ce7c
- SHA1 c57c7220578e542f249bbade1dc4cf6e4dff3508
- SHA512 6b2152e412869e99637b6fc06e4f58aa573ef1ce0803690ea7629903d83dab731c969027bed7b5fdf212f7819066f40e27d43c3f5db82892e52215124fde3b04
- TLSH
  T1E6F0C900EC022835AFE853B6ED051177AB5BE513400E1DD2929B45A0A8297CA25F68BD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

defense_evasion
behavioral27 behavioral28
- Target
  millennium/plugins/ltsteamplugin/backend/scripts/downloader.ps1
- Size 2KB
- SHA256 2d5d6157fa62ac40ee0f6b8f3acece182258cc9283957f90074ebaffe5aeed9a
- MD5 ebc959b282af6b7ed9036fc4204a451b
- SHA1 e6036876a87a701f3df7f45a701c0f32bc4dc41b
- SHA512 6a8bfb133d58c138ad7fc0ac95a3c96d074fb65a992b10780d5ebc8dad326882d1b9e38ebbfe66456b9a52c0ac7f2c6f5468834e86a26a007b02fce1cee489af
- TLSH
  T14741657040C043618EC3066D5C4CA4082E661177709E2EA1FDCC93D2BFF96288EB7BAB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  millennium/plugins/ltsteamplugin/backend/scripts/downloader.sh
- Size 802B
- SHA256 8f68002b55fcb79a3c53e3ac662b5c01e23819e8426a69cedc668fe36d151235
- MD5 5f04a20fb05271e7c4884efd6f941918
- SHA1 b49fee729486743c093b4e21b7306e37ae76968e
- SHA512 95865ff092d0b614ec410fccd08b90866ebc3fb1862951231e3f0bc03db5465037b935b96be50c79b5fef65fddc657476ce2e9d97d6c19c5580b89a74fefbef6
- TLSH
  T1A201264AB08663BF14E715485E4FA0A43CA236638E1C6D28B51C21A82F36592F77C71F
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral31 behavioral32