80eeba30d596bb746bb75d59fdb2c663b89bf6865b8b097c001f6ca8b1a75c81

Sharing

Copy URL Twitter E-mail

General

Target
windows.zip
Size 14.6MB
Sample260626-zbd3asft7m
SHA256 80eeba30d596bb746bb75d59fdb2c663b89bf6865b8b097c001f6ca8b1a75c81
MD5 74292599bbcf42dc5c42bea5f79fc41c
SHA1 b06cff2a34cf1d4708c0ea82f272cbba1d648175
SHA512 3da404c1ffdb93c73a04a8559e1bcd473a425a3508cb8b736df16b82b610929d43ebca0061f04fce919faa6dc4b7a79386e04fabf70fc91154e89c4dbbcd0248
SSDEEP 393216:IepGd3HJqYnKT4+nYPzx616zrlR4/aeYvFardpYy:56X+T4pPd6Izc/xwFard+y
TLSH
T128F6339852D70821CEF7733F18BB925576C57842BDF06E253F989DA72BC30B4086AC99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lunar Client Qt/Qt5Core.dll
- Size 7.8MB
- SHA256 858abb9ddcb3cd4fa15c01d3cd64ff4371a79516b02bc3df20590a82161fba55
- MD5 f38f9d503157c6b2401801f9572fd048
- SHA1 52f999e93532349d0fca73f49e7a4e987b4a5e1f
- SHA512 c31966139cb1d5df66ea5cfde65b09449d5f25d5c4fc146cd44f0e0124e8106eef124fc40e2522aaee571e4685e605ebbcab8305a23d00ab9d7828c70a7f1be3
- SSDEEP 196608:N84evpspTjPCixOJsv6tWKFdu9CUGSFj+p:NNevpIT2TJsv6tWKFdu9C4g
- TLSH
  T158866B83B6D7449DC96BC638C6DBA33375357C428732AE6F5244AB351E22FC02B1A719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Lunar Client Qt/Qt5Gui.dll
- Size 9.2MB
- SHA256 8bcf807aaf2419843a778994187fa4a2fe9e2d926435ed8add3e670935b3f9aa
- MD5 fc7d92feb89f055f7f19169e7a1f3621
- SHA1 5a0f1b5fa82f419020fb38010340032971495dcd
- SHA512 e97dbc3afc7875dd753c10804aa1c98abc6462f4a295ef88f9f96292a620d607f8d67fb3172a4eca72664f7c0e928e2709dfff42586f516c4ba3567fa4a334e0
- SSDEEP 98304:4jXCr0pPxu7Ve0VW0I4UZYS437MU1MXUDyfK:Oyr0pv0VW0qYDLMUX
- TLSH
  T1BBA66CD3B5D298CDC927D63886EBE332B5347C954332AE6B52508B352E53FC02B1A719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Lunar Client Qt/Qt5Network.dll
- Size 2.6MB
- SHA256 7660849b5647d0cd1c893fd0f977474df7b968bfae17cec79dbc77359f4e01f3
- MD5 94da65cb700658388a9cc3478abee446
- SHA1 d6eb041d57a730ca203a00c925281bc112a99fda
- SHA512 d71046b4a48ee6b085d10131a4bdd77045258685d6d10cff8626e7c5ed1a02218e095dc5e3a63b57868d84ab71b41e1265b7f8cf87fe462c90e8d7ec1248e699
- SSDEEP 49152:duOO43/DCdP/4O5WPkryQ/HiCn3Ihf15PA3/ITe:dtFs/dn+hPI/ge
- TLSH
  T197C51B93B2D658DEC96AC738C5D7D3337538B8918332AFAB46149B351E42F812B6D348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Lunar Client Qt/Qt5Svg.dll
- Size 566KB
- SHA256 25ad9cf13bbef3b7f7f99c8effc25aedd20dcf8b2455e4b685ebb27d510f9ecc
- MD5 7b80103c5e287dc427a6e9435ab05f35
- SHA1 272f90165ff6d440e2d4ce21f69eeb44ac8a5c9b
- SHA512 522037c7aa50cbf122d1e11e1b0284afe7b7f77dc6f1fafd89d803816e8ab92a98b8f9a14c2cca45bcc475405f4b6c89ba9da3973572982a903d38fd6bfff2cd
- SSDEEP 6144:L/C5POseyOirW00dvVLZfQGWIbZpqLf+sia1FSafmeVdtH5OMavK1qUWKarhiZ0Y:LKEsUirW0YdLub0c9l
- TLSH
  T16DC4C7E2B2C54CCEEAB6863C85C6D321353E7CD153329F6B86204736AE01ED57DA5782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Lunar Client Qt/Qt5Widgets.dll
- Size 8.3MB
- SHA256 f1cdc4e0717d054a654373c52d98b8730d4dfd48eac0e5d9f518d9cede45fcdd
- MD5 f4cf06dedf04a732be32acd1291cf032
- SHA1 8b9f8b822722537cf3043bc0e3a0069c33c1c66b
- SHA512 e0dd90285afafeef96776c268672283604c61502f7ca7d165b054654e6ca960f0e9087f56693fad48d4d18c78b44fe7e5f05988739e789a1712440c3a742dc3a
- SSDEEP 49152:rSMPF2bpm2G9ZoRpLYAELJGZ+9gOfXFipQcwZR4XRDFT8wedoyq+QkniEDXvpTxW:rUpmSkLY+GDyC/qWjxLKg6fW+jVD8
- TLSH
  T162963A83B2C69CDECE6BD7388AD7D32275347C858733AF2F56108B351E42AD02A5A715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Lunar Client Qt/agents (DON'T TOUCH)/UnlockCosmetics
- Size 563KB
- SHA256 cd24b33057f1fa4da6deb971a5ce50a479716672119d5a1fd6d6a0de89fe5318
- MD5 fe43cecf015b2991fa1ef69abf834238
- SHA1 ecda71b09b6816630cb571167fa09df9f451eb9d
- SHA512 1ab8687626f64c906ee82ef2b4f6040ae127122b2e1ae61e1a7e0131618495dfa011eb942c96d09282e378f60f7de62ccd0000e1470dfa9b6a2b722ed800fad6
- SSDEEP 12288:KqoB1wJELKUhek8lmmTDP94sMjOZTXopDHlUXTVlU6HMZjzs4CeFkPaZ:K1vwqhe5DSsMjOFXcHSXTVuwMZjqykSZ
- TLSH
  T1D6C401297E7AC430F1A3643292804557F51D4A8AE65EE09709A53A4D18FFEC1CB3BBCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Lunar Client Qt/bearer/qgenericbearer.dll
- Size 156KB
- SHA256 f57c87490f18899e5980c24a504896ad86b595848de8d23846871fda0cb93503
- MD5 d3df6e5210541f5e719ce2691a79f203
- SHA1 324849a4ee44740d293ce39e42a6901bcbafdc7e
- SHA512 8c70de2cd099cab78251e0d99e91e51d982b67af1e7a11f174c2d3eea518679d4a3fb7ec75c1037e8770562b56735bb398c32aa4d38f8137350fa7c1f9a0f689
- SSDEEP 3072:UWc1rglrQWRaUbJGEKdD0SW/N0oBuIlXfIlL9v8z:Uzy8WBChgN0oBuIlXfIlL9v8z
- TLSH
  T1D7F364E133C55DCFE915473D86C6D322633DF8D14323DBAB66786A3A0F42E81399924A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Lunar Client Qt/iconengines/qsvgicon.dll
- Size 97KB
- SHA256 e458a825d98be0c0a60e8fa50ded20d21f36a84141ba78422466611a6f790968
- MD5 4f717969032d4cb764a58a88b69c9389
- SHA1 2125a9b44e5fbd5c30d2a1704e9546dccfb5edb5
- SHA512 bd4d40c7d6791ac243c75aa1e529e6264fd8a7b33cbfc7970989d49bb040a8e33b8a0b1f40ea2cea77c6dcc24f155c2a30e4c809aaf7d1e13e931f83fa189eda
- SSDEEP 3072:PhiVBYy246eWf31ioQYN8CmkBfxg8EkU/:JiVBYy2PeWf118CmkBfxg8ET/
- TLSH
  T126A37FE173D89EC7EA61923C42C6D322673CB9E253138F5B553C9A321F11E9239D5B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Lunar Client Qt/imageformats/qgif.dll
- Size 78KB
- SHA256 d50521b169a6326aef57437e6e51efd4bfad298f958cf51b778a5990c3311a68
- MD5 6643793ba0c0d45dd5cccde0a5b25d33
- SHA1 92cc3a8febb2178e90da189ba8a1bd2bd7732ea2
- SHA512 5dd99c63ed9b915e2678195be7815e7abc2f2b1f71441679810be215b840d28830c230ceb56f67ffc3c1d4a2067971e31e6a861563396990447a5130d841e543
- SSDEEP 1536:GJ1xnxBXZoy2Eo9WYghCnKfvmaIMFqq9AcfiUfDsZUfF:GJ1xnxBXZoYo9WYgbmHMFqq9AcfiUfDD
- TLSH
  T1257360D6B7E49D9AEA62823C92CAC232633CFED152138B57113C96311F12FC239D571A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Lunar Client Qt/imageformats/qico.dll
- Size 81KB
- SHA256 a721b24ca1fa0187891ec899a8a0e969e4e2c3a7d1d01edc97ceffea9e379026
- MD5 7da403414b84b57eaee35fef9a907152
- SHA1 19dab25959851e5c5876131ae6479e2809ac51eb
- SHA512 2b1037bff4e07e3f91a52140770f755e03f54204d91d0a81ebad472aaae73ad5b20d450de5a9748434a7d1727046bb1a0342608c578377b02854364a3f2ef1fa
- SSDEEP 1536:T9vXN/kS6XMWxZsJDJRIvEAzloT/vqfM+AbeBTUfE:BNqXMWxZtEAzloT/vqfM+AbeBf
- TLSH
  T1FF835FE6B7E89E86EA6582784386C332673CFDE056238B57113C96324F52FC639C5306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Lunar Client Qt/imageformats/qjpeg.dll
- Size 476KB
- SHA256 830442002bb18dc98a97090942cf8dd892d264e6031123c856e2acee8b2d89d7
- MD5 5efa4cbf69cea6e2e5db46492b6fb31a
- SHA1 4c282dffbebcab838e56cd3ab11e71b62ed7e0fd
- SHA512 14686738e281113caec512b30165a18b8dbb982add6bab3447508fe69c666f1072d93febedbd07bde0660143b5489bf3a2ca5900375a7e8f8ccd2c1de3b43926
- SSDEEP 6144:kNnLzZc+4dtRABmfnvJru/rmIjwP3oXg4fzAWYyRH9OirkePfWiZBkM:kNnL9xOnDzN4Zdr4M
- TLSH
  T111A4D597B5A11C8FDBD68138CE96D232673879AD53F38B773128D5F03E12D913A89A04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Lunar Client Qt/imageformats/qsvg.dll
- Size 74KB
- SHA256 eb6861b1577f7ebc210a8120198c199e24b666f79b67b28f64aaeb77331378ad
- MD5 0cf17da428a03ff8825abca5405da38a
- SHA1 ba397600e84587c4dec0bdcaa4b645dac2bfb42c
- SHA512 fc04d23e3809808f337790ad62570237f4fc6d87802e6fbce9a49d8bc973165e13b3311feb8803f1c12241d56ca7073928006d70a945024be9d10b5c50bf8575
- SSDEEP 1536:9VJZnhMkWkDnT8apNWDD2FE+Mf54uUcd024Ufw:5ZhMkWk75oDCFE+Mf54uUZ2U
- TLSH
  T1ED733DA5B6D89E86EA64827C93CAD322633CFED047138F17523C86325F52F8679D5306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Lunar Client Qt/libcrypto-1_1-x64.dll
- Size 2.7MB
- SHA256 c246b0eac5994f7726689202de782b9f7c88678cf9d19250d481bb437c88fe64
- MD5 dcf3de145792e70012a4a5df58ad03d9
- SHA1 fc433ba10170c5a22fedaaafbeb0dbd379cfd22e
- SHA512 3bfb2cbe4fc5b7df782ada6cdf5a40aa1d3c528b06f154559d7de5804d8cebac376699af6489f78d024bbdb26140092b3fce103d857bd7e98d5e0d4b60320184
- SSDEEP 49152:zVwAsO8nXHeus0vM6zu/IU6iFveYXpBJLKAmE7sRGtlqb5TNC3h3PDuKPftSw/Fl:0+usisQ+FvTXpBJLK9/5Ter79Sw/F31j
- TLSH
  T1B6D57B17F6A710EDCE6BC170CAEB9772B571B85802B0BEBB2254DA302E13D50571EB58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Lunar Client Qt/libgcc_s_seh-1.dll
- Size 105KB
- SHA256 1c25cb5cab8ad14c1440f1cc0baaafde44e5bde1091597fbeee1ce3a089a259d
- MD5 1130dd2875e1cb8a5df7cbce5103792f
- SHA1 eb6af7a8b3c793bd96937b2459ba59e04df0eaa6
- SHA512 e162fc20cf553ec0ec1640598a57182be7e37733dbbfab2bfc039ebdb8d8b8a3fd74dfa5915ad0b085d310032f69f44d79cb3f42ada0442046016b70009652a8
- SSDEEP 1536:CcQQpjWqbh1sbMl8d4RR68AP4FopvcRJ3n0ubJ6AZg2JSQ+kgj2ZDFwlF2:3gqDsbMedKlNycRh0hAPvgyOlF2
- TLSH
  T101B32A57F693A4FCC192F1708A839BB1D836BC744330A9332754FA3C6DB2E819E1A655
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Lunar Client Qt/libssl-1_1-x64.dll
- Size 558KB
- SHA256 5e58885f69e6967bdc66c486653b46f87042f45d7c6c4c4482fa1cb3d1eb6ea1
- MD5 f35287a0b966b591e07b8b90ef01b184
- SHA1 281a8dfa0ed5b1838b318c0180a1f19a8e08eea1
- SHA512 a51fa8099b461d52a4f8fa5f4bd8974e6db01108627a5e3f74c5a83af495f40f20a69751b5410bf32cf86d6744d4bd6a49862c6d825b350a204ff6e1b0bc04c4
- SSDEEP 12288:hzjTs6ZKX9niPNeurm/XxGotFk71xFUhMmvuD9Gkt:hzjo3X9niPNUTFk71xFUhMmvuD9Gkt
- TLSH
  T127C40862E6A315ADCAA7C27DCB979772F53AB4201331BD6B0254CF301F21F54272E968
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Lunar Client Qt/libstdc++-6.dll
- Size 1.9MB
- SHA256 5e212ae907c8ba17b5b2878ea8bbf11dc54cbdf33ee5b93eb2d23c0339fbfaad
- MD5 49245caf4d03b49cb1ce1c98c0d41497
- SHA1 be169c1434cb19334c260e97629497a977d0cecd
- SHA512 6ba9dc809eed69698903b346427d8b569f14aaf7062723afb22fff42fb8d131d144fdc7606151a4f7ae7589c053a40d05038d1279e807d3852f2394372c1415d
- SSDEEP 24576:NVvTTxC8fvTGou5gIK5sMX/uiCtx/lz03vYnhSMXlrEyfwSdB0d4PcCtMM:jvTTnvTGoUcsMX/uiCtx/mYpLcCtMM
- TLSH
  T157954B1396A34D78CDDBEBB4925B57369A20FC2546383C6E5E98C7306F22D80936FB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32