General
- Target LuaTools-win-Setup.exe
- Size 11.0MB
- Sample260710-t657dacz7j
- SHA256 c9150869839883b7849b37aa801d6f69111a9c5d6cf556c0a296bc961c55aa42
- MD5 0c2a06bd26f63b6e655328518f77095e
- SHA1 f6b6d4ead5b9739d77b729ed156f5022a497daff
- SHA512 ff1bb530aee1acbbe541b36440b423784eac163a14c3ab9281ed0b876a5bd833f0687dd39d8c89b9a7cf917a8f9008e420c169d576eefa03ce87088adfc7d56f
- SSDEEP 196608:K4MyYSDTgGziuS0040yF5NFrjPnN4Sw6qHn3ILn03t+6E4Ufl:iJSngpT60ojFrjfN4SwVI70bUd
- TLSH T1A1C60162FF02D0BBD48A01B5D43EB73DB6369E95872A85C34AA93C5CA8F1270585335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LuaTools-win-Setup.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
LuaTools-win-Setup.exe
Resource
win11ltsc2024-20260709-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target LuaTools-win-Setup.exe
- Size 11.0MB
- SHA256 c9150869839883b7849b37aa801d6f69111a9c5d6cf556c0a296bc961c55aa42
- MD5 0c2a06bd26f63b6e655328518f77095e
- SHA1 f6b6d4ead5b9739d77b729ed156f5022a497daff
- SHA512 ff1bb530aee1acbbe541b36440b423784eac163a14c3ab9281ed0b876a5bd833f0687dd39d8c89b9a7cf917a8f9008e420c169d576eefa03ce87088adfc7d56f
- SSDEEP 196608:K4MyYSDTgGziuS0040yF5NFrjPnN4Sw6qHn3ILn03t+6E4Ufl:iJSngpT60ojFrjfN4SwVI70bUd
- TLSH T1A1C60162FF02D0BBD48A01B5D43EB73DB6369E95872A85C34AA93C5CA8F1270585335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.