General
- Target LunaFeries.exe
- Size 139.2MB
- Sample260623-27ls5agy9n
- SHA256 8a402da499058cc359ae4d3b059e326bb0b0230d6dee40c956ada4f9f8d1ad05
Malware Config
Targets
-
- Target LunaFeries.exe
- Size 139.2MB
- SHA256 8a402da499058cc359ae4d3b059e326bb0b0230d6dee40c956ada4f9f8d1ad05
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
Score4/10 -
- Target LunaFeries.exe
- Size 168.5MB
- SHA256 beb0f051c9b00f37d97ca0bacf6ad9e7071136297f5b272ac98983beae4b7c71
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target dxcompiler.dll
- Size 20.8MB
- SHA256 51952faea76a3c913a021899d891b6cc1c6f924a980da6b664e4b662de9d353d
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 47ffdbd85438891b7963408ea26151ba26ae1b303bbdab3a55f0f11056085893
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 e85618dfe2a1b2c20174f8e628e9d542065ba73ef257ad6a2bceaabacb9e3dc8
Score1/10 -
- Target libEGL.dll
- Size 467KB
- SHA256 337b7e187c7ea739032380d3a9d1f50e29761562ca9475836b36a42e3dbc9fa5
Score1/10 -
- Target libGLESv2.dll
- Size 7.4MB
- SHA256 2ffccd773bac3e3c5cc9e3a43f89deba8456f2bcaba85496af7013445b413f2d
Score1/10 -
- Target resources/elevate.exe
- Size 119KB
- SHA256 55b0f7a58faa83c3b9898d13062959df46667c3173b779fed42de5d57118cbaa
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.0MB
- SHA256 9068181e7a22521e9d908aeaed2d3a0171437fe4581de65982e2a47bc0dc1408
Score1/10 -
- Target vulkan-1.dll
- Size 925KB
- SHA256 6008f82da0997edb4f0ed2fa5818e3c993aac82d58b12174d5b204ca00e3fba3
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1