General
- Target Luna Executor.zip
- Size 5.4MB
- Sample260705-ybehdsaz9n
- SHA256 bb72bb9a3e46dc45a9cab9fd3dcd438f42dbbc45a2baf141c401469ca2d6bca7
- MD5 83800aba141ffa77e57a187625271e50
- SHA1 dc61cf6b365db72c8f7937f426843c8b748a81d5
- SHA512 4fe601bad76fdea830de3cbe886bf49029f23dec46431e1d8d1e83a34a9f4f32e4612f11bb37b74a99209f83dbde5c646bdae609e5e36f7f8cc533197e116db2
- SSDEEP 98304:P5OQ3bX493Z8QxwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxX:hFIBSQxw/tyd3w++lz0byX
- TLSH T1E646023BF28B647DE06A56367AB29110953B7E6166124C4797ECF48CCF221B01E3E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
.exe
Resource
win11-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target .Store
- Size 3.4MB
- SHA256 377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79
- MD5 15596b41dba42cdcce4f677fbbc86b6e
- SHA1 1ed1e69e72028150f8562bff5ca1dd745874329a
- SHA512 d4e0d64f71027ecc6d85479542ed682359b37446cb1dccce5fa2972f152e27f3cb91a8ec0dc61270bc40038751a58982d4678efb929a3bc6d3546e072f51a9f2
- SSDEEP 98304:HwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxm:Hw/tyd3w++lz0bym
- TLSH T1CDF5234AF7951CF4E5A3E2758AA1450BE3737C563B3093CF2760566A2F232915E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target Luna Executor.exe
- Size 2.0MB
- SHA256 3a83dba04f444c7294de14fbc4a4d743b9dd3029d0cc62fcf0bfc57a9213defc
- MD5 52a181aa8b78e6f1032259242831fa00
- SHA1 264dac0bea2ab323ce8778c8f53fc36cdc2460c1
- SHA512 2e1f4afae2911a414a7f3aea163206dc09c0b268ced1f391fc92f94bb5e035338f595cba228d104cb8e3405f80f95eb622115c2c5804479e2c583161f80ffe09
- SSDEEP 49152:4uI2h3bA1Hu8x/3ok9bz4pICVmkZ866OC:45OQ3bX493Z8QC
- TLSH T1CAA5C03FF28B653EE06A16367A72A110983B7A6165124C1696FCF88CCF355701E3E787
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1