01687f1fd28dfab23e3f3b10b798421df41a304368a3ce02726f301cc64bb887

Resubmissions

02/07/2026, 22:34

260702-2g23esfy5x

02/07/2026, 22:27

260702-2dh55scv8j8

Sharing

Copy URL Twitter E-mail

General

Target
lunar-standalone (2).zip
Size 4.0MB
Sample260702-2dh55scv8j
SHA256 01687f1fd28dfab23e3f3b10b798421df41a304368a3ce02726f301cc64bb887
MD5 5b227aa9ba1db28d4c480c3268d9078e
SHA1 97ac242647d7d467117dc1ebc31adeaa616e0ddb
SHA512 d8a2c1887ddf320a02f1891760fdbd93710c2f9955278f167bcc3e65966035f62962269cf2b87e2d1d63ae79cc8b6e9a68be87da9afc85d7755f5ac3544f7738
SSDEEP 98304:iQb49Qsh7GjjdFZg1FzWx5b1foyvK8hRJC7e7l7iVa4ZREE:EHMTSsuAV7leaaR
TLSH
T1281602B9E3B910A7DE4F7339FA4DE1594ADFB75B3D026801070E5B8A3DC80625560E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  lunar-standalone/server/node_modules/call-bind-apply-helpers/actualApply.js
- Size 280B
- SHA256 1cbe921bb00b03294815ff0ece4212f276870466961773ce238802bc71474540
- MD5 1947214a3c7396147c556b0e3c69a19f
- SHA1 b8a8ac0989695147a9853a45b293f763dbb820ce
- SHA512 dbf9ba8edff5335d49b944e8596642aa616ded09a5f17013e3c33b4ddcd6012ce5c866f4810e4ab1ce3ac25f285f5990aaa709cd753f745aa6b6489228a075e1
- TLSH
  T10DD012CC96E3F445A0605791C5FA8C4668B2C87123888567461E84ED09FC1C95B93DBF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  lunar-standalone/server/node_modules/call-bind-apply-helpers/applyBind.js
- Size 264B
- SHA256 3e65d83cecb93fa80dc5ad4d86d98f9e715e101ac3d8ec56d36ee669f1180bd0
- MD5 abfb68a073938f3b65d630ec327c0a78
- SHA1 3c929655a4f990ccf2ee626fe61caa7c8d048656
- SHA512 0a78d67dc9aeb097add6c771ea3207a960c35eed434060c7a005bd19bb5798b7bbed1ae5cc5f6f2f4f7fc1afe99d33d3826d7660c674dbc4c45a88ed4ad24740
- TLSH
  T1D3D02BC869D2F4C5B22001D5CE7B840968B7CCB401C4C264820CC0EC08B00CEEB33C5E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  lunar-standalone/server/node_modules/call-bind-apply-helpers/functionApply.js
- Size 99B
- SHA256 6170e997fbe03c6f8ff48946ada7d54c7aadc01531509af81f0edfdb7be00e27
- MD5 1990aa9e219b457e8c524e34e23134d5
- SHA1 00d6ee4fe117f91a053a80b2559aec6b34c565b0
- SHA512 35cf701f7b4b490ef907aa909e8c28125241f5b56e8349d67305da1bd3f36451c184fb0d6199df70754aef031c012a96e138d14eacbce3ad81c87a4cbc46b727
- TLSH
  T1D4B0124DD9313056130101A4C68BB41D68B4047C5214E7BA0E4856F008F984C2711B44
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  lunar-standalone/server/node_modules/call-bind-apply-helpers/functionCall.js
- Size 97B
- SHA256 22d50c812748973250e9aa1994882a880c6e3bfc90d45e41f609cab97beee3fe
- MD5 c13d55372e3773cd2ef02d3f913ba636
- SHA1 6f03b2ad80c4407c2311b5265927eb42fcd37065
- SHA512 afca794b359f7bdd7faf7eaa8f8ab3c364a7a1c21745526beed06ffd4acef5746ee057c68eeaafe9dde1c82b3fe19f0cb7bf57b048669d8c990b3626d4fa34a3
- TLSH
  T132B0124D9C303196430112F0D28BA42E28B4403C1214A6BA0D4866F50AF994C1412B58
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  lunar-standalone/server/node_modules/call-bind-apply-helpers/index.js
- Size 511B
- SHA256 6a7ff51e964c2f1e24e3f3a90f41895bec230f07c3001eb29f45741ff99d7a83
- MD5 8f16ee8a45b865279368356a4480a973
- SHA1 b78a2b9a8c65a18d4841869943e9709aa7b1cf52
- SHA512 06c7ffa1455c697026afd5a6b8d3808dad284287a69a3337213518d1486eff555b5f3e7b2c24ce15f3406565c81b995666aa1703d0df7ff52d7dcbbf32f65425
- TLSH
  T12CF0598937E5E165A23266E0C87FAA4D69A3C82A15098075912FF1F80DF00DC8F53D7D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  lunar-standalone/server/node_modules/call-bind-apply-helpers/reflectApply.js
- Size 132B
- SHA256 e3ee45fb4c54bdb5f76ad4ef42780da004412ddb6d668993de4b9014efe246ff
- MD5 96fee6c01641b68e80a18ec2cd8d70a7
- SHA1 2667e65cbae1541b4cf2d3cae190a6ca51911187
- SHA512 035550b26ba77f2e901ae31a482367e5b8536d57239f27a65e6f11601737cd7b4a876d5ce8d10dbc1398049423b1834586a6c9a32d06671bf509378278c232e5
- TLSH
  T1F1C09BCD4573545551C400D4D5D3FD11B461887103545B790F4C59F9055C5C9DE94787
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  lunar-standalone/server/node_modules/call-bind-apply-helpers/test/index.js
- Size 2KB
- SHA256 8f68f29a54d276f06f12fe2143196130180e839ea75171b09e73c242433efeea
- MD5 57bb911c83d0a67e58e5ee171555e469
- SHA1 835b4e3bd8cb5b34b89fc04e247f93d929361bf4
- SHA512 f382e97b3e3996478a68c60a3a1915a0a197bdc49053d31227734612a996edf73097684e43080deed991e39cdf33e53f39024939235fb58f72e228a8ece73e25
- TLSH
  T18051F086CAD1C06D4764FAF191EB3F4DA7019073435E4898C13DE6268E924BF2B88DE2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  lunar-standalone/server/node_modules/call-bound/index.js
- Size 687B
- SHA256 aaf524d09b5a4f8f732a516aa1c81e6e8c5d65ae3d01bce392e8fc1ac55c14ff
- MD5 5b5220b8faab66a250c92068d9d1ffd8
- SHA1 8e55119c703cec0ceb0eeeb3b2bffb4dbb325bc9
- SHA512 c82bf2029fd03c9802ad17b354bdbd1abdcea6b857c39ccef791c6d143e1ce93c250eb2eca6174f783a7f9d1f9f106f3e02d0d68ed8efcd876c6b5de6e4eb2f3
- TLSH
  T1C7012B84B597933C432037E085F64B2C6D7EDC35513450EC85ADD2B356D249C4536EA8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  lunar-standalone/server/node_modules/content-disposition/README.md
- Size 5KB
- SHA256 871c5ec648b67ad1a5791c6c4f95e5bb5df78ecc9aae0a3387e2a08e068c6968
- MD5 cbd415ae5e4605f9ce13640c323d8aaf
- SHA1 e1d109d584a63de2418adfd8fb59b298d0d9368e
- SHA512 4454179d3ddeeb49393df168db1867d19054c44b60e1da5ff5555d26a8f0ba9cc5f3d5dadce76ebcf0110924c440a10e01969ff701076a38a2ff8673db6325d9
- SSDEEP 96:eXCnQ5B17X/AU4M58ZBB/WfUt41lFXTpGa+O/iOu:eyAFXz58ZBMT1l9bru
- TLSH
  T1C2B176A6174466310743F36C768FB156F73CD80EA6435048A4C981ADB3DEA65E2F3BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  lunar-standalone/server/node_modules/content-disposition/index.js
- Size 10KB
- SHA256 e86a88a5d1a9dd74faa753ca4e47a78e38ae930f3206e5e887cf6cb0ad70cbf8
- MD5 43a307ff7de26dbec523ec966c434f94
- SHA1 ed7f187b72a7b1f81d113bad5aa9347c242120d5
- SHA512 79c073d3f0dea6c1606029b9a476cdce30ebbfb7b6ca95935a2e3f2cc97e70f3f00dbe8b7067beea78dae120f4941e60a7aa26592cff18e5cdf56f335127092d
- SSDEEP 192:NnPSCe5ZBHNVzX1t6/khk3bnEm+4qcVupDAGJvyAJK:NnPSD5ZBttXbMqenircgDAwrK
- TLSH
  T1CB225254A8C260108B9766F445DFA71164ACE10B322F68E9F8DFA7641F8DC7091BAFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  lunar-standalone/server/node_modules/content-type/README.md
- Size 2KB
- SHA256 8793880cbc4fd7294dff8562b71d9381ea1c0557422b66007920415ba439486e
- MD5 cb19c8aba870601aee363ac2302da33d
- SHA1 f41b2b41f354438d6ed00d1d028b54a93fa15862
- SHA512 58991d9dcc472f56d93bf69b65ef6c5d0b1f4ad0a094a812411e75d32adbe9a54ffb3739ddeb71dced591bf2be220740bc17aff7e9087069c0dce94a99b3468f
- TLSH
  T1F7510EF723089377271A93E5784F71AEC651C852F752C81968A49A7CA1C9F1AD0F13AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  lunar-standalone/server/node_modules/content-type/index.js
- Size 4KB
- SHA256 7d76ae0f8ecc0a8c053de97b0f695f3fa3df33f692d1bd241307995304e5f63d
- MD5 4781c7ea0309edac61c3a36e3ea9da10
- SHA1 1b6e7e8d1963ce958cf0f225223fadb5ef12f86d
- SHA512 d458f8962f44ec30bf519a54aef063960d9cac2a954493383fc2ef46781c3244740f18c7daf1821b4e0babbd56b356228f7247ce40de9f3276de91a71c66c78c
- SSDEEP 96:CJFvvhHgqZlI8IDzdlalSqZf/gf6GosMySqUqMGa9Nw+j0i8L:CJFHhAqbI8IdUYVhvJMG6Yii
- TLSH
  T198A1B658E5D2A0014A4B14F445FEA612D0F5C00B321D19BAB4EF87B85FC8875D87AFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  lunar-standalone/server/node_modules/cookie-signature/Readme.md
- Size 1KB
- SHA256 1621ed10d0b2f865eb8608e0474a356cf7a9737a384b6593b61b30a9f6e50366
- MD5 57ae8b42de3dd0c1f22d5f4cf191e15a
- SHA1 eedf0ded937f36b8ff5054a5b08cf38fdc241deb
- SHA512 c725e8c112ae4ffb9593c512636d1c9208cf10bfb055901a00d0dc892c95617ad3300829256972bb3996914b085d0a862207d214d0f9342741135d7e1e0ecb91
- TLSH
  T126316A1F73E4076F009D033059B758956359915F65CF658C042DF34573254DD7AFB884
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  lunar-standalone/server/node_modules/cookie-signature/index.js
- Size 1KB
- SHA256 00e0107e1d234ff33db54244d1a5d737bb028187fb5d83faa56a670b1cda043f
- MD5 e42d32de575c733b7479832c71e1f9ef
- SHA1 c054b69237e1d09f6a63a5729ab7f86438b6b772
- SHA512 3658051b1af7da2be7c96cc98c3f19c78487c215847e3273d9d1215e1c4e6cd3f82376c9a52799473514c0445f60953efef2a3bb5a9592a11679277faa4c70d6
- TLSH
  T19221DF5639B0B16352A71073B4A3C8427DD9889226BD44F5E34C14A93EDC8728634DD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  lunar-standalone/server/node_modules/cookie/README.md
- Size 11KB
- SHA256 ba8b36c7d860d6ef37887b6ef496a486e91aefe5229f65157cc8b44725b9bec5
- MD5 683e2286b5cb5bd1b4b36866f573a29f
- SHA1 a4d68d3f76512c87cfbcf6a6e553876d1980a6e8
- SHA512 8f6fa08988cabc1d90f6523d3ca2d09e89622aecbf2e954e67241a076f43d3db0eca3bb16b28cd0259e851305631f8dc42299a78aa400ce0623ac90b7c56c218
- SSDEEP 192:gC6nTuN1D5AKINreMblbEnV4zrhw5lPOkRHPL+gqdd7SHlxlmzrMtCT8+cNkq:QuN1D+9eMbFES36RHPL+b8xQTimq
- TLSH
  T1ED32CA9B37055B3A0F6301F5F19FB0A8D720401A547AE26C78DC927A2B4A457CA3F6DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  lunar-standalone/server/node_modules/cookie/index.js
- Size 7KB
- SHA256 a88f6d7257e3403b727b90a2f3f5c03591e14eaa0b217c501b7071074f080e42
- MD5 1a55cb971e8f83cd258453811f313801
- SHA1 45c75a7b867435a2c309bd08bc27eabef93a010b
- SHA512 29c6b3ad2cfa7634c075c2b46b6f26359823a68bcbb0e3d70c177f599790f11bccda44a42a8680fc7a5fa9f047f87263590cbc03f5327085aad44d8ad1c6e986
- SSDEEP 192:GIe8sU8PjSGyGEN7P3SnGQAk4lL4B1RQhAU+iGazI:GIejUgSGyGEN7UxCUB1RQhAU+fx
- TLSH
  T1D4F1C75C6AE0606285E732788A9FA542E6729017112B88EC34DDD3F00FC44F99A7DFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32