3347ed7d452822d58567579380230244d11fab89cc48731ac2b4b1e0387e782d

Sharing

Copy URL Twitter E-mail

General

Target
Lumen.zip
Size 32.4MB
Sample260623-ta1a9aes3s
SHA256 3347ed7d452822d58567579380230244d11fab89cc48731ac2b4b1e0387e782d
MD5 9042e729b2de48fe11b9ce26cd109db5
SHA1 f1f1b14ecc38804578a9df7d6f3d008529577c26
SHA512 9a4154e4db6d5399886ff67bd016954cb5243b191056ac58855244812b22c409d05cba42fd4c093d9ac144faafad8dbac1f0bb3309e4a8b7fe1ed3c8dee3c705
SSDEEP 786432:N2M6TvzckI635a+qD40d1Dz3F+6x7s31zfhe24ik7qhv0/lbkx1KqSn:4vzckI6pRqk0rDrFxls3V5e24ihp0/lr
TLSH
T14677333FB90A9032C5FACA74903C58F15FDB776401D5319BA10E92605A83EF6AD0BB6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  App/glib-2.dll
- Size 1.5MB
- SHA256 81a230e78e0776aa4135b16334c88b8e79a1c6dfa0f02767a315d4cf830f760a
- MD5 0affc650b9d57ee9ec20d4853ca682b7
- SHA1 ac4a44e6718b4aa3435285dea46a40000cb42336
- SHA512 e6caa0654b29a7149c6414837844657439f297fc963cbce7bd08269a370f11149305f685fa3b5a8596d346015dcd9873714af0503dd839b53aa54b253843dfe9
- SSDEEP 49152:W2MQDrpzAK9ztBcoXwnTgJWKYYPAsSGtvg:WhM9zN95wnTGlYYIb
- TLSH
  T1CC754B56A38535EBEB96CD7588A15353E27174080F2365CB2E6CD6692B3FBE30236F04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  App/gmodule-2.dll
- Size 18KB
- SHA256 06f404a0b560ee9321b80617c95583a60d6dee15188c2324175a53bd239cade2
- MD5 c7fcf63e8d98dc0881c783a2496e7522
- SHA1 328fd4f28ec72495384a1c6fc75fa0bfc52424f2
- SHA512 d88b655c9749b0bc7a6ffd56b73ff279363719130593e3636b9d31bbbb1b140dfa091a8ca531497f2dfcc58d3f4f87277ae55e80012778f2d4c0eb09b17f2f5c
- SSDEEP 192:tek5uNjRGazHUtt1PChcqsuh1V3WaeBHzt5ee0izXgnNOe9/gemvcqnB5HO:Ek4TGPtnEcqsuD00NNR/gemBBI
- TLSH
  T1E7824A04EBE054C6E596C1B9D8A36E17D5B1B66143E157CF5360EAA80F333836B72B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  App/icudt75.dll
- Size 29.3MB
- SHA256 184c87cb375eb7bf70ba89774d6f38363d7430b15a38a5641f1d1394183cc75e
- MD5 f15d500fe1db5575ce1f367343f50a3c
- SHA1 39ef8e0f3e1da49f919cda2946889ee493f238a5
- SHA512 84524c72badea178a84c1c0ecdd57ed8fbb762158d3e9f0dfb3101946c1fa06e427230fb7a944596717d22da0e1756cc9b6e9dcb22b2674f41ebc393bbfb4097
- SSDEEP 393216:mzVhxxOXBDFesiXUxpWJ9IWlY3IDUl2nogg9WbkxyBtS//JO47TW9U0PprgdES5w:cvxOOx
- TLSH
  T1E367085266FF48C1FEFB6F319CF652638567FD067E31804D62042B2A5D733A08962B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  App/icuin75.dll
- Size 3.4MB
- SHA256 84433735ef601f56482e8aca3fd4f596b23c9e01e5460cff6c12e0dfdc67c64d
- MD5 08d2bbe52ca0cf93e8f40110d10eab65
- SHA1 5d09bf9d9157b8b873c822a4111cad813ed06ee9
- SHA512 0d6b812374016b9b56f0c7cac2c60db2660bf1287dbc0c649460e9adb173163e38b5bd2d7f823c31510bd54668aa3cb6e250df1f655b2798c33ad52a8829a52b
- SSDEEP 49152:voYNtFOwewvQLtiXcrP8Ueh3LAWJlRO49vu17Vb46z:ZkjU
- TLSH
  T1C1F55A17B3A60196C07AC1BCC99A8126F6FAB82043529ADB025DC71D7F53BD369FE350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  App/icuio75.dll
- Size 61KB
- SHA256 ed1261f4dc60fa9dda937f82b8686cb1300b975721f19a1bd9a53eea7960af82
- MD5 1ddb33416c861ee7a43b8ab0f5e55b97
- SHA1 660169f3c87f6e6047a09f085ed2dfaefe91548e
- SHA512 f2f8ae1c2405e9fd1202b31dfab836482fbcee8ce8cd3472df811ce7e7ee9fdedc55c691202bd20e165a2545dfbfd81d4d603108871f3a5f7892f8eb929931e0
- SSDEEP 1536:8V2FtHyPA0yIPiiZ8OAqy+Dy1i5T8M+8BSr:FXiZ8Fw6Y0r
- TLSH
  T169536D6AA3C840D8C1B7C278C4871B22F3F5B8141365ABCF82E5865E1F6BBD97679341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  App/icuuc75.dll
- Size 2.3MB
- SHA256 bfe2fdf2f1f5c35e0633e3d76d9ae4aa2060a00414df08a43521579b37a01539
- MD5 fdb638f40d0fdb5c263308817d4f9a69
- SHA1 49e30bb8ec477516ad88346647076b7a8dacd1e0
- SHA512 65d2570f6c9ea7b39b6dc09febebd29648dc21f7bfa48a3937fa4575eb891282fe379149179961c4447ae585c82ddc1913c6c866c5557f0c5aff2ae10149571e
- SSDEEP 49152:xMi0T5UJhB8fbRzVT3GO8uKpPIT8GGhNJRFnDaX:xMihBObJ86j0npDa
- TLSH
  T10CB57C07F2DA4099C16BD13C8AA74395E2B27C241F21EBD7159586993F63BE122FE3D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  App/libcrypto-3-x64.dll
- Size 6.9MB
- SHA256 b2e0afe48a3c8f67cabd80aae16749e66e314f02a9fc530fc8888be1d7fa2762
- MD5 0ff0f38cf3c35baafcffcd2a1f4235ea
- SHA1 8e516e65ce06f70846ed3dacca7cc3f50fe7f675
- SHA512 9ad48fdb78c4ead12dfcf296cf8581112de0c48320c70c701743e403d88e6e0897384c936a59662738db9cf94da680b1432489b82008507d47c9e70fc8d5b71f
- SSDEEP 196608:ccQzPIzlTBGOibQb6AB1CPwDvt3uFA0Cm:ccQzgzldGOibApB1CPwDvt3uF3C
- TLSH
  T155767BADA6BC0149E8AB91BDC2875327D771B91957B013CF186186F80F23FD92B7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  App/libenchant2.dll
- Size 43KB
- SHA256 3db6d34fdf418b6796d5dcc07cd69d9361ce41d1a66b53f23590e162408d3b53
- MD5 a78719eb8eba0c8e611c34f6551bf7e1
- SHA1 107dcbc9334815276b4baf83420a55f192cb1d9a
- SHA512 45e8f71a38a9d9af2096a8503034bb2effcc4edc1bee56737f8828d4e24b2efd56ea4846bbb8bc83e214418ec78637bf7c88965304b55a3e8eea53ec7c4d1d05
- SSDEEP 768:pISAwXSBV/cow5OC1eqt3ijD7KcRD012T1O:OSAISBVc1Xf92T1O
- TLSH
  T189135B56E64800DBD577C138D9B6BA1BE2F1341133A167CF2A60C5381FB3DD26A3AB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  App/libpq.dll
- Size 318KB
- SHA256 a6697c287b30a26ee698829f225e290a330391d601d766fb8dfd4c5cc95ffd0a
- MD5 996721bfbdb1aa680c12151fb0ed8537
- SHA1 34731a2d6a69cc63abc77a85748de72536f9c934
- SHA512 78fe629b4d4fe433d85ffbe9acf5723842d65ed72993e077ceb04466e54b81af2fe65897dd8bee65847743980d8bd76c3d005a2c6530dd598319501cce18b8d1
- SSDEEP 6144:dOQZE652SNI1ZxUai+XAlPbpOHzI4l/4OMx7apSPOL6:cQ149AlPbYrOY6
- TLSH
  T19464494AB2D1095ADD5B83398E57C117CAB634210322CBDF03A19A7D7F236FAB938715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  App/libsasl.dll
- Size 209KB
- SHA256 76f3f3a125230b8b97254cb8c98aa0f98bcc4960434cd5b53912f1f6fd75cd2d
- MD5 3facc682f865c1ec60f83e2f320e3ea4
- SHA1 4d8b0b91c2d78231253ec943403e4960bd5a1721
- SHA512 c730730c0b4d1b8516a673073c5f6b65680f4ddb0a0e26134e022e6464bd1358ac21a5acf6f809fa79a73fae99ede52e868ed20bdc666381750233f1f7a9fdfc
- SSDEEP 3072:eTi0aZFg1JV05s3DKR1TLeBhy2Wx19UBttsvTKgHyCgCTg26Lqh:esZ+JIszKLQyx19UbIGaH6Lq
- TLSH
  T188245C57B2E160E8E163C1388563D503E3B6B4553710ABEB06A0C7791F63EE2E23D799
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  App/libsodium.dll
- Size 340KB
- SHA256 20f66cafeb53acfa1677eb3c741218fa392f811b3c9fb6c31e8a6e64bdb6bc1a
- MD5 d6ff5740ca899be2fc733166df011423
- SHA1 cbb30044f8068660f4767b7411a6ec79abb2a203
- SHA512 c613e15362f641022f15023fdb53c354a18dbd69214198c82d1476fd35ed6b9af370119ea106514b77265a93b19bbde7d7ff05f16779796b3955e2ccb4f1b370
- SSDEEP 6144:KtqLf57lIT/cDNUxKy5twkSXxTlNazeaV5V50DErUg4X:6sR2/cutwXXlrCeaID
- TLSH
  T187747C5EFEE6AEE8CD77E07C827EC266FA51380C4371A6D713D2459428537E59238B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  App/libsqlite3.dll
- Size 1.6MB
- SHA256 55a3803a52931b52631e2e758da1a5fb79960c6854463670e87bd17b8f386933
- MD5 5698378e864ef5ebda2321562f3934bb
- SHA1 be96898eee236a15bb42d89c326ddee965f3d581
- SHA512 e727ae9c47c476341908de8b7f13d38833bdc762d93fbd2a431ec6e406ffd66af5567296dd65d97365c9ac12a27859bf9d46a273a3b8d90477b1fd201dd38f6f
- SSDEEP 24576:uN4SqpGldBD0fhZ/xWUKff83owLAQ6/wqdxQkuz+PrKmYYpme2fFQCVAG34V/3J:mGpsdGfZW7f83owH6IESk7P0YqfF
- TLSH
  T170857C47B3B9019CD567C27C89576707E6F2B44523146BCB16A08AAA2F33FE51B7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  App/libssh2.dll
- Size 409KB
- SHA256 cfaba22333cf2716ac14474d1764b168b9ad38f9f11d9e666d31c95be868326d
- MD5 b1be9a10cf63422c419a749414f84e92
- SHA1 ef731cbfd60a8a08601f8251169b9abfbc93969c
- SHA512 8a491a54b62b15dd89f65e6d97550b357114c247a3911a7dce0b9ecea3ac8e6c4e230b2fb4fc6292b842c1d13e137c18faddf48d77b3dc80283f9f8c2e62e2a7
- SSDEEP 6144:Cc2hINSuz/HH3cUBMicj38/gAJanMYdvJE/vWZQ+4IqRD77m2HCU:CDhIN1MUy+MFyD77m2i
- TLSH
  T176947C1AE7A42595D0B7C078D5E34627EB70748D43688ACF01E0E76A2F23BE16B3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  App/libssl-3-x64.dll
- Size 1.3MB
- SHA256 690c137472250a14956094bc11b93edcc01eb4a347ca3ebf4bdf42404e42b26d
- MD5 574a7be17e29058a59803c447c637e9c
- SHA1 1ad9c10e8ac3df1ad87add37601782a1d55465ad
- SHA512 b9f1680c0044e64ffde89ad04be006f130a4cdb9ca980a710ae64b6c88f6c5398d92ee61a4b942e5083044764ec41ceb4dc94dd44bdba5f7a4997c7f14f374b9
- SSDEEP 12288:dyPwS7qRexaXsenAju9H2zdmqTfYyV1vPowckF9M0K9YWsVu+/xiRg5aYs:UPMbcedHAmK/V1vPvp9M0KBgERg5aYs
- TLSH
  T137556D5AA7B801ADE5B7C17CC6934A23D2B2F4162370A7EF06618A791F23BD6173D344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Lumen.exe
- Size 3.5MB
- SHA256 c6e186b84f610926077260f2d0f8e9cea8da03d353e37b4f27948877810e5ae1
- MD5 e876a47c72dd3492af2d612e19e5e3b5
- SHA1 1b04f7208c352048ee4fa81444cbf894d4bd758c
- SHA512 10eb6fa96312fa639ecfd4582aff73dec45e7c0e931f22817fa572f93211e36ef22bc04493261e68263ebe71450c4b692538f22f963e50fe8473f53c63c25c10
- SSDEEP 98304:6Wi2+TsmvzemeoeoepNICzvcOpoUvp7gSo:JfvM
- TLSH
  T1ABF518437ADB0DA5CDD66BB861D39335A334FD35CB2A4F2BA648C5322D532C1AD1AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral29 behavioral30
- Target
  data/ErrorReport.dll
- Size 77KB
- SHA256 60239317fb4b636867fab34c665dd7b0fe99a10c19376f7dca98c0388dacd18f
- MD5 a19afd00795061ede25d9e98326d8915
- SHA1 27117806618db2fe45922f84b0c8fab6daa45898
- SHA512 42fde982e83097b3c2f7858488228b3147ba332cb56ead52bc823b1b8ca3b3168079b46472a70f5f14f492fc6498bc0354e192a3baa2a27e20e8bf856351405a
- SSDEEP 1536:RyYLAD6mIotsFYsw0usSneV6Py+JOl/naS5C1eT3hzi:RyQmIotsF00Eu6Py+JOl/n9k1eVi
- TLSH
  T1ED735A0A376841AEF027C17ED2A3C74AEBB274406B2097CF46A8875E1F237D55D3572A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32