5b7bdebc485857321ce51da698d6033c2e108aa13a2bff0ad85828a263d10582

Sharing

Copy URL Twitter E-mail

General

Target
LuaTools-win-Portable.zip
Size 6.5MB
Sample260705-v1n7caas7r
SHA256 5b7bdebc485857321ce51da698d6033c2e108aa13a2bff0ad85828a263d10582
MD5 55863394b509c05458ea2a3825676a96
SHA1 cd8e26c2eef7ac9060fc688fe79671f82595ca78
SHA512 d5e559b486ecdd7960cceb2485b93fba272f04f92c4708a3165e4d759596e370a653371cfa6a65b705cbe7a3927a6dae39e06832a5f110f87de5154a27379a6c
SSDEEP 196608:z2jPnN4Sw6qxke002mQF57Ze9rILn03t+6E4UwCu5MR:CjfN4Sw0e4myJZeI70bUw0R
TLSH
T19F66331E87189BB9C12BD6B1413C09EF8793772E6392376A422C33C3ADCE7B9D654245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  current/ar/LuaTools.resources.dll
- Size 29KB
- SHA256 850b118e990e5007bf5fc80b67313ba2f76da87fe572493f8737bed306bcbbd0
- MD5 64b4b5eba41527d4183be7cd937806ac
- SHA1 7c1e9fb814639a769800d46612c81eb41c90ca9b
- SHA512 8f8bdf072c6a8c51f8234ca9d6c6c82d7d549f740474ad1af76f7c5fa9efde7f81ac2d799382203a0c8b386dae2e69a4e22edd9150656545ec1609bf61d6bb85
- SSDEEP 768:MUxwB1ayQjNzENGIj2pZYV8GGVXEmMrH30l:MUxwB1ayyNzENzj2p6V8GG9EmMr30l
- TLSH
  T161D22F9117F841B8FAB79F3AE2B52469C876FCF28D46F42C1047150989A3B11DEA8733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  current/bg/LuaTools.resources.dll
- Size 32KB
- SHA256 bb7e3878d4a2f0588a58bcafdeecf698c505f770ff19c9e58c73b3abb13405e6
- MD5 21f8ec3afd106f7331cb556b51e7e809
- SHA1 7eff821569e059c9503a5e66cffb3f9b6f80906c
- SHA512 64eadb64da70771a77bbd027c5afe0c84467d614ce5349a0e9f8aa9db6631dcdccc386553ced84f9d021c734a2decc52385f0cd5fa2573c047cf64f47f548f11
- SSDEEP 384:CG4tGUPc+afJEOQlTUJITQnOWMKuGjixSn3okUGhMJ2477e6c1j3wVBF+9q9ES3b:LU0ITQbGeokEiWAvle
- TLSH
  T1AEE2FD5047E914AAF572AF7BAD342D092CBABCFE3F52D20D0054185D38F2664CAB572E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  current/cs/LuaTools.resources.dll
- Size 26KB
- SHA256 68c428e66943a4a0838e0607fffe73f9536e74f26e236cab8a401426858a3190
- MD5 082c122beee0a4955852944cc2dfb131
- SHA1 b2c1b2d93f469a6f5495e1f3a730a603af42f8a9
- SHA512 0bf4a1dbe84ecb0bfac210c7a68926dc0d3134c4ad55e6d08208eb181200cc91f30704fdaee1518737d8de41bbf51fcb0842301676a357752008a5f6dcdc0237
- SSDEEP 768:4ULSA3tpfZwoz4tgnuWR4h7nyKTYVi7iYjQ6bR+:4ULp37fZwuuz7b1+
- TLSH
  T141C24E146AF801B8F5F35F7A7A760425993AFDE60C02E46E018A158E0D73B64DEB1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  current/da/LuaTools.resources.dll
- Size 25KB
- SHA256 877caeabad30861b0ad41a46218869e93613f0066a151980bc9c8eadacd21ba5
- MD5 7df10a7b131b6a854b620b82a37e87cd
- SHA1 d1026cab5ab13da09310236c3ae4f786f8e2f155
- SHA512 585744c00b2d2d53c997c39f37cf1922f35ecab4c27c2ed3e8eded48fa3acb47f6b45cbfa150c3a23367ca6918cfa94d85e793eb859db52df2ccddb067ad0f28
- SSDEEP 384:1YGUPJuWDPj+SVzQfqNy0/28k58qRIQOqeiLwd+mBpFyZoHpLEV4NvZ9xiFchI1:RUhLNYajqVGpFyCHpLEV4tZ9xjI1
- TLSH
  T188C21D41ABF815BCF5B70FBAAA364926497AFCFA8C01D41E0189514E0973B50CEB5737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  current/de/LuaTools.resources.dll
- Size 27KB
- SHA256 4a53636e9a82e43c1c0c5978ce29ae2a786a746bdeec6b2511cca616e7c78a6e
- MD5 044cc0e684defbfca1724d387baf6f1f
- SHA1 17271d5d170ffb58582cb2bc9f530ee90a4698ac
- SHA512 029edcb87559aa4de8ba3552d3d072a7fea4671f089ab39e7247d277c21e239be06f636592daf6cda597f73ff138b7e2f54fad1a9d7176e2852a15e2a7148587
- SSDEEP 384:GSGUP9/QzfhNPZklFhEHo04wWzszhvLGOUUQQIOY7jb4HfrryOegi1aXGbfB/o7P:SUVIHocvUPvk/rmOegipfBWTOtu5
- TLSH
  T1A0C260016AFD12BCF1F36F757A7A48266A7AFCE60C02E01D0189514E49A3765CEB8737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  current/el/LuaTools.resources.dll
- Size 33KB
- SHA256 30724225bec51ac3c8da5bd91553e10d2b41fc57be62a38ec3bfcb76c1160f2b
- MD5 cbe0726a8af5cd1aeff1fb6e233ea0d7
- SHA1 84d1e8ece9d209eef7923beee0630971c00d7ad6
- SHA512 a4ee8caec309e936cf6143c02438d5e57564f282cd2e13275bdd870c6236012713c9a2030580600958213bc5afc08c7a5b0d9b644ce2a5afbe214d6bcabdd285
- SSDEEP 768:dUtVNbub0FBCHR09rolEeJjuFcpasMTUM807zrfF:dUtfbub0FBt9roiKuJsMYMpr9
- TLSH
  T146F21E8FB6E81DBCF0B69F7359B814391B66BCA96D01D59C1129C2493CF5660CE30B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  current/es-419/LuaTools.resources.dll
- Size 26KB
- SHA256 b0c25364d233ac3ef0eeae55bc249d1acba29ce65c2fc1f4913005d920ec56b8
- MD5 d5597c4461e6a62f48cfb99051960b58
- SHA1 63df51931e3f1c3cee52216b59c4f2893a0e3cd5
- SHA512 def39306be8ad83bbae9a148455097234011a85f02cb329af67faef869d0c41c7e051f780c8001041f6a78b42631afd5d2d3df11429aaba53fc6436baa9fe614
- SSDEEP 384:aCGUPmx8Q43iCtd6aI/DgQKBMjLRrkKPG7PrBwtinCcFtdCZRy6oYLQTX7Ey/:qUeXDg4GicC0eC4y/
- TLSH
  T160C252516BFC06B8F4F31F76AA7285164979FCE61C01E41D015A125E09B3B84CEB2B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  current/es/LuaTools.resources.dll
- Size 26KB
- SHA256 9c87f27acfa6d971b990abae975e0be09c40aac4b85f32189e4427963b8071ae
- MD5 c7c7f9f92eea23bdb8d7146c5db44356
- SHA1 6d0e8834deade55dc21d553c77d6ce25e6d20ba8
- SHA512 f2fdb4e69138e21b2a6dd4d04ee51c4e08f4b34d0610cfefcaadf37119309d33513085e1cbd3fae8b6282042703bdba2bd70386966f41e68c86d11e4e3a5c059
- SSDEEP 384:FMGUPmx8jUR1YPzfWYg0iNP2pUbzpVod91CDTva8BZ6mcFtdgZRy6oYTQshTcL:xUeVSUMCtQm0IGL
- TLSH
  T12AC25151ABF806B8F4F31FB6AA7285165979FCE61C02D41D015A124E09B2F84DEB2B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  current/fi/LuaTools.resources.dll
- Size 26KB
- SHA256 b207b4f924e87eaed5192b9f2e603e3558f5ba2103f3ce55256aa51140f73966
- MD5 65cfa0a0eab1a71dc30b3e08341573d6
- SHA1 79d39bc77b9288c15a20290bef8db9f5ea129776
- SHA512 0cd67590bdcc0d35858b5b94abdeddac8a1a6158d628846a1ad787837d1e06007da2ba9f75b5ad9db8330375941c6a34e4e1591e13840264d318abf28a0e61cc
- SSDEEP 384:jWxGUPrxHyBbBGBobN3kiCpyNLvxwrAS2WT04zTebkScayMx4caMpW09LctlW9zj:LUDKk+RS7+ZIMBauD9oXCWJJ+
- TLSH
  T171C2624167FC42BCF0F76FB9AA7504264879FCE94C11D84D424A618E48B2B90DEB1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  current/fr/LuaTools.resources.dll
- Size 27KB
- SHA256 99006db64c3384c71f2c7dffbe2c413a3968fea95c66d67833f8245697370ee1
- MD5 5c6709d7f7798697e05705c3289a9ee5
- SHA1 7f270c6eb806b69ec32408cc234882f22f8dc9af
- SHA512 14435935225dd99f85ceffbee8067efa8d1072a350d2e9639265e215bb4767789b9117b733039d1d672c51848bbae9dcc29e25673dec6c6e7605edd8d09d62ae
- SSDEEP 384:O+CGUPUzU+39GY+LhI/TwcE3Gw8CUWt7XFuixwh+nb8Tuz+pD1MOxdg9ws1v:DU8lTwJ7XiAAnZSOb6ws1v
- TLSH
  T184C250456BF812ACF5F35F76BA3245168839FCE66D12E01C014A158E0973BA8CEB5B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  current/hu/LuaTools.resources.dll
- Size 27KB
- SHA256 7a7b863fd0819a69ab827eb72b7801f018db329def0c48a2d394bf1bc715294d
- MD5 08cbfb09dcdf04ed898842ed18ab0277
- SHA1 1b6c41eaf9adbd7deef78abfc7385a73ae838dbe
- SHA512 9cb696c30dfa9a0aed6eb949faa4f224d8e8d9d4f87bfe8e211c2ef33850be3c8c364a5592856b75c4745828f4dae966a20f90996faf20a0dc94d973d399d20d
- SSDEEP 384:MhGUPmA8nL6kvkuQCxH690YUvbjQPD4+U4/L1GNjDGKJwQM7gXphHsTe:bUeA8z+u1DrU8phEe
- TLSH
  T19BC22E6267F8126DF4F36F76BA350816497AFCF60D12E42D114A148E4872B54CEB2B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  current/id/LuaTools.resources.dll
- Size 26KB
- SHA256 b0b6caa771fa0ab9f08831051a4fc389fe7152367f6e53b6aca5d6edac573d44
- MD5 09664f409cd7fb100c58b601916e3f39
- SHA1 ed1f13eb9b7006e9ba27e4a61fe301a323dfcadc
- SHA512 b7896c6a7e74842c2097eea7e4f56228f76c437479cf8cb2f63f523333e7b8a640fc8e15f6fc172a11f0fe4fa86f3775d0264d4dbf81ccbcdb889332edd92a56
- SSDEEP 384:tgGUPyG9dYMAmYAXcx82Dywn+YhCJ2XWmGFgd6nSRmSC3MSf50dM8GY4wYdH:VUaZLWTjSaNuykYR
- TLSH
  T1CCC22D019BFC116CF8B75FB6AA7549161C3AFDE65E02E41D06680A9E0873B50CEB1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  current/it/LuaTools.resources.dll
- Size 26KB
- SHA256 a258400e15e96842acf81efa48e22c0f055cf727310e93e1cad2a25cabb0a846
- MD5 3057f8331d91633c5a7fd5cc4a042291
- SHA1 63acd597eca34f403e4ec59b8b9e0a9cfb7e3bad
- SHA512 602b36c108c63683b5737616477fcec607eb137d4b828c5638403491c07d7a220db36446c9ede58c4889538d8d9123b5bd8b30f7290134a9f0da3809a683e049
- SSDEEP 384:azwGUPBYLl5si0WV7JGSpvcxBxmbylsb0Dz67DDtNJL7DDL2PwtQ6pzuU8DMEgLt:aLUpDSpT0czL2PwbpcjgrFD
- TLSH
  T1DFC251506BFC027CF4B31FBAAA3654565A7EFCE65C02E41D0189124E19A3B94CEB1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  current/ja/LuaTools.resources.dll
- Size 29KB
- SHA256 85a94df6893fcc624a97304434bddcdd8d87784d7cdc0b9efc811643dd6d3574
- MD5 03b8ffb3cf6bb550a98257671f9f0f11
- SHA1 62cc148c4d9e87035ae78b80c7e4f90dd87516ec
- SHA512 73543afef8c0e12492d7f266a1856c1872513a7dfb37e8d21701c73d9e4444d00b2377fc33321b41dc0c7d98d0824b5408e916c1a2106c8575693ba7ccebec71
- SSDEEP 384:7aGUPKSpMWOXp7GC0ecqbiBmNrbaFk/aJ42f2ST46reUy2/CmzMZO9gbmNYK/Kk9:1Ui3biJJiH5xyMZScOYK+Zg
- TLSH
  T172D23F2CA7ED0579F8B30F72687925929935BCEADC12E82D015E901C5D72B4DDE60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  current/ko/LuaTools.resources.dll
- Size 27KB
- SHA256 109db43579df4edd7aa4300dd8e0dcb1e78c4f138f4d0104ab1ffdc2a69e82d8
- MD5 918fcb76e69c21dfadacc38c40a4094c
- SHA1 aa325fe459ee3dc4362d6ccaa8c5eb22202d3c0a
- SHA512 fe9b1f41f2b8960862aab4982666a7773779cae626e008ef45e3298433d753d27f639927a48d124b7492cd7e13c5572381baeeab45f7d3686866b7acc98c4806
- SSDEEP 768:BUWJ4/0rEC+T1lPz3zsFCCbU9WXYJ20OPLOp6zE:BUWy/mECk3Pz3ZCbUi+hWLWYE
- TLSH
  T1E6C25F512BFE12A8F0F39FB26AB459154AA5FCF25E03D05C4544498E4D72B85CEB1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  current/nb/LuaTools.resources.dll
- Size 25KB
- SHA256 22e87d25c0e49839f04cfe6869279b1ca9cbd2e34745e1509e93a8e8001fffa0
- MD5 b86c3091130268989463f31c9ac1986a
- SHA1 1e07a88e88108527f87a095db5d60379ef64a2aa
- SHA512 2016df618cc1bb1675222754c00703a8332c2fd61711727dfbac23ba18cac9790693e07184dfab88437693cb3d55e06f4d4d17386ae4806278093272bb6ae143
- SSDEEP 384:4eGUPMABschG2fiORxSUJpCyZShqwdWoD/d5Y+kdRwm1MIWn148nNrh5+c0oPGJc:YUkFYeyCyZwYn1Ay8nNrhAc0oPGFw
- TLSH
  T157C23F41ABF8127CF5B35FBA793909264D3AFCEA8C12D85D0189514E0963B90CEB5737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32