fbd679ca9bab4b5edffc365b904158f781a0ed216a7caf5ae54668f6b998746e

Sharing

Copy URL Twitter E-mail

General

Target
LunaExecutor.zip
Size 75.7MB
Sample260706-qlx4gsfx4s
SHA256 fbd679ca9bab4b5edffc365b904158f781a0ed216a7caf5ae54668f6b998746e
MD5 94f71bed7c84a1b18375dae90639a92f
SHA1 920ae5d6fc920ae76dd80709d57dd52ec321896e
SHA512 13d894cc656f2cf9412221bb074a61a0327c77e55674f1d1d911cbae252ce7130cfdf49a0ef008ff2aaa39bc3df3d9b1002848695da196aaf292d23bb083a4a7
SSDEEP 1572864:sjArvJuhtpjk2HxE0uokHzaSiquHvA5vwC1XzJO/WlGzpIW:vvEVjk2ZuNTniqev7OFOlIW
TLSH
T1370833AE83AE5793CE105AF1D613003FF9B96A0D1B6B784F157F229244097F5D8322AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LunaExecutor.zip
- Size 75.7MB
- SHA256 fbd679ca9bab4b5edffc365b904158f781a0ed216a7caf5ae54668f6b998746e
- MD5 94f71bed7c84a1b18375dae90639a92f
- SHA1 920ae5d6fc920ae76dd80709d57dd52ec321896e
- SHA512 13d894cc656f2cf9412221bb074a61a0327c77e55674f1d1d911cbae252ce7130cfdf49a0ef008ff2aaa39bc3df3d9b1002848695da196aaf292d23bb083a4a7
- SSDEEP 1572864:sjArvJuhtpjk2HxE0uokHzaSiquHvA5vwC1XzJO/WlGzpIW:vvEVjk2ZuNTniqev7OFOlIW
- TLSH
  T1370833AE83AE5793CE105AF1D613003FF9B96A0D1B6B784F157F229244097F5D8322AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  LunaExecutor/LunaExecutor.exe
- Size 2.4MB
- SHA256 6338d76fb8584b3c01acd3e54894a18acdc4991e27cb0ef38bc813048be0426c
- MD5 11681120205a14f8173a4dd80526988c
- SHA1 f91e610277bdf419b6d6a0c504f995b062e7f355
- SHA512 bfd7be6cd25fff773cee9d59c1fe022b5845791428c49f8c8429a7f26f1bceae570a05fd4f851f92dbeea9f8511a52699880303fe2b18e5c59937c1e0bda3e06
- SSDEEP 49152:/odiePhExLauAMPjZ98wotnCh20QlEL6/Ewvl4TxsaNFc5WgkwFI:/Oh+majM4YELDFzrCI
- TLSH
  T1FEC52917E2A360FCCA6BC134865BA772B971B8580130BE7F5554CB302F71EA0576EB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral4 behavioral5 behavioral6
- Target
  LunaExecutor/libiconv-2.dll
- Size 1.1MB
- SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
- MD5 ba98508c9c8fb1681193aeffdbfa535e
- SHA1 789489f95afe79a531373099336310707f0199ff
- SHA512 992c8dba9e2a76bc8dfb2986d637c9005d8e607631dc7a9b5d16597b741421d3c287a1be27a885dfe360ce46e5f4b4b4282c18aa2f4582264ea285d993cf994e
- SSDEEP 24576:fyRg1BAUZLY3wPKo6VbbTOZGavkg3NyeuQ6l9fH+ftFHo:6Rg1BAUZLYgio6IZGaXBuQQ9etFI
- TLSH
  T10535BE51F3D2CB2BF263C6B0C9AA5B26E427EC216B0645337660B3BC5D33BA415C8566
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8 behavioral9
- Target
  LunaExecutor/libintl-8.dll
- Size 301KB
- SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
- MD5 83f4bfec7f089f4a9efd5b36690b6cd7
- SHA1 8f9b913c8c4724c70eddab906fb1465e4fcb0dbf
- SHA512 43a4049e6ca85b90fe9b325b301b6c23d94d2045e0b218b0d0495c539ec22c6f43b2f4fd589b77b3945d0f9f2938e84db9c534aeb79fa5b929102b0c6eeeb20e
- SSDEEP 6144:DqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJB:6WcOXow+8Wmiwd+TuoJB
- TLSH
  T11C642907B24395D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E329515B19B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12
- Target
  LunaExecutor/libpcre2-8-0.dll
- Size 711KB
- SHA256 413b0fd931d5e98e0fc70bb37d33c7aaca9d4a2b0321ec6060bdd716d80dfd92
- MD5 8a360488bff85ff1da8ab57fe40df98b
- SHA1 0e841e0fbe1f3245eafe0fac26d75862b83f0da4
- SHA512 c6549584035244e0cfa9ce36c02671fbda9482268d02f1c450e65653b9e434323569113c5a403a6bb3242b10aef599d14c4a6ba88865d6b74279e09fa2909b43
- SSDEEP 12288:C/94uwmMo7Q++CDdewFv4/iIhZ9SsChldffAf/fmjFUWu:C/Cy7BDd94/6sEXI3fmjFUWu
- TLSH
  T193F4D547F4E321E8CD36C175E7B732B2F53639E91035BDAE16A0C3312E139216A5AA1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15
- Target
  LunaExecutor/libwinpthread-1.dll
- Size 27.3MB
- SHA256 643024ac92130aee2fbc0819913ce1b8bd1579193a2b8f4b7f3441cdfb5c401d
- MD5 6514a4efca209a4b1d1c0d3296dc0455
- SHA1 30d7065c1bd2cd3d8078dacb1148dbd0684e7929
- SHA512 dc06fae5ef6616171cf956b63b2576c947af4134697037492aa60f52dad7e690eba8ca5206aa36998475763f9c994f80a3d5d767b9c6e0241b58efb8dbd97be8
- SSDEEP 49152:qckamyaAx5X1FV68m1gFpAmUsmPQTUlR9tP1F4JTqfywiqjjinq9:qUesmPQTUf9tP1F4JTqfywiqjjinq9
- TLSH
  T11E578D17B3D41E95D467CA30C61B9732F3B2F9660731E28B05B4D6492E73BB14B2A632
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17 behavioral18
- Target
  LunaExecutor/ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21
- Target
  LunaExecutor/vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23 behavioral24
- Target
  LunaExecutor/vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26 behavioral27
- Target
  LunaExecutor/zlib1.dll
- Size 128KB
- SHA256 49dea0fa4f407054ff10b459e8dadb6443cc0ca8aefcd19d9864dd0423b27501
- MD5 189289e121629c125a1d1e8be51f0324
- SHA1 f86ef2fe11269fd45f7c5d8c4b523ed8e445b56b
- SHA512 9693347fd0bf9c6d05c288aa09a892368b32d4c2288ed74dcb62358787f034465c17ac5b409dfeb261a7055bf6b2d9479ba03defbcd39c50caad1dbc7e8e3dee
- SSDEEP 3072:Ljf8ECbYiB317HVhVpaKdAAcsrK2M2nuh2UI6vTH2F3/Fb1:fLCbYiBp1LghAxG9BI6LH2F3/X
- TLSH
  T1F2D38D9BF8A265E9C6B7C17085D78B72F930F81106746EBB4258E7742E22F405B1C2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28 behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of SetThreadContext

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30