General
- Target LuaTools-win-Setup.exe
- Size 10.9MB
- Sample260623-lrvs4abx6p
- SHA256 bd48aba914fc8d96377a12cb8cb8ad8705d94753de52769623ff957c8208e389
- MD5 e0bbdd8e4f18abdd7388bbe7dbab7dcd
- SHA1 a399eb320daa349968f4160240df359a9f14186d
- SHA512 c525ac7ba15a513800863e31c6eb86283eed579d3e62f3b017e0ea1c5aab43ebe1a7f6e071d68f228f86de8cdc976cea786059eaea9effb15591115d1a3170fb
- SSDEEP 196608:K4MyYKDTgGBRQr20040yF5NFsjPnN4Sw6qHn3ILn03t+6E4Ubr:iJKngPr260ojFsjfN4SwVI70bUX
- TLSH T11BB60162FF02D0BBD48A01B5D43EB73DB6369E95872A85D34AA9385CA8F1370581335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LuaTools-win-Setup.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
LuaTools-win-Setup.exe
Resource
win11ltsc2024-20260617-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target LuaTools-win-Setup.exe
- Size 10.9MB
- SHA256 bd48aba914fc8d96377a12cb8cb8ad8705d94753de52769623ff957c8208e389
- MD5 e0bbdd8e4f18abdd7388bbe7dbab7dcd
- SHA1 a399eb320daa349968f4160240df359a9f14186d
- SHA512 c525ac7ba15a513800863e31c6eb86283eed579d3e62f3b017e0ea1c5aab43ebe1a7f6e071d68f228f86de8cdc976cea786059eaea9effb15591115d1a3170fb
- SSDEEP 196608:K4MyYKDTgGBRQr20040yF5NFsjPnN4Sw6qHn3ILn03t+6E4Ubr:iJKngPr260ojFsjfN4SwVI70bUX
- TLSH T11BB60162FF02D0BBD48A01B5D43EB73DB6369E95872A85D34AA9385CA8F1370581335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.