1ac98b335412d61c7950b2ed452238ebb7873c63e8f547d163e00e0b678aafc2

Sharing

Copy URL Twitter E-mail

General

Target
Lunar Client - Installer.exe
Size 3.1MB
Sample260715-g32cssgv61
SHA256 1ac98b335412d61c7950b2ed452238ebb7873c63e8f547d163e00e0b678aafc2
MD5 cff7fa3e5e57ee50cbb73acee4a67fd4
SHA1 deb573b96ea96f38b420d83ce1f49f6227dd347c
SHA512 29c19e7901197a6fac0f5e068c409cb19c70d8a039962ab518758f7f8f7ee3141523037a4c0b238e1f72e5493b0b1f6e60f888d99b788f2b5d0834dd3b326210
SSDEEP 49152:TmABJv6xE87vxpsrFpIvQ4kvoHch90kesLWciYEXHIw3UhsooAFhR8MSh9YHzcYq:ThcPN+TIvrWccYxncxoHrkhsbc8MyYT
TLSH
T1DEE523E4B820CC3DE6310EF9B6F4C056E7B8CD39682945897761B5853A32E4EDE4782D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lunar Client - Installer.exe
- Size 3.1MB
- SHA256 1ac98b335412d61c7950b2ed452238ebb7873c63e8f547d163e00e0b678aafc2
- MD5 cff7fa3e5e57ee50cbb73acee4a67fd4
- SHA1 deb573b96ea96f38b420d83ce1f49f6227dd347c
- SHA512 29c19e7901197a6fac0f5e068c409cb19c70d8a039962ab518758f7f8f7ee3141523037a4c0b238e1f72e5493b0b1f6e60f888d99b788f2b5d0834dd3b326210
- SSDEEP 49152:TmABJv6xE87vxpsrFpIvQ4kvoHch90kesLWciYEXHIw3UhsooAFhR8MSh9YHzcYq:ThcPN+TIvrWccYxncxoHrkhsbc8MyYT
- TLSH
  T1DEE523E4B820CC3DE6310EF9B6F4C056E7B8CD39682945897761B5853A32E4EDE4782D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Downloads MZ/PE file
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/app/cmp.html
- Size 5KB
- SHA256 5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c
- MD5 17241946e51074e6877c43737b94ad71
- SHA1 16918c53471fe3f35fcae1e9902870d91c50d957
- SHA512 b4b6e030fd1abe19fa308b32f04571a7c1c1f78a7cb789f169b37b54f281ec66d16e4cf0bbbdad81642bf28e266a6b2af7c19cf5106c683fb7f443bfa3110e05
- SSDEEP 48:tZrc0/GdshWpo1rckthAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4Li1:4V+8v4jHa2NGiivmmpWsBVuQFwlE5vSG
- TLSH
  T15DB1DB1A2D5914A80077E3385B6B6208F72AA1B72105CA067EACDE513FB152BD58FFCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/app/index.html
- Size 27KB
- SHA256 f3a33ad0c5dcdbba535684fc8f6f8514cc144bea144f099f48e632e724f76eba
- MD5 2d53b20d968ed838e92efec419fb03f1
- SHA1 c12bb51b851e94bd28c35a88e4796da33452199f
- SHA512 66e2794754798183109d69097ea9d11cff7fa9d545cd230d03cead441a4bb47d0d23b74a85c3286b21cd9ad734042042e5284f438af1c4ac3ddeb46882cb77fb
- SSDEEP 384:vN7Y6FCs5XRJ/seq06IfLglbyMaAt1vnE++ggevsu5SwU:z5XX/seq06IfLglbyMai5n30u0wU
- TLSH
  T167C2A611DA36202DB137462A75E2BA5D3034C117E5639A7EFA5C9674CBCB18B1F23B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app/js/app.js
- Size 24KB
- SHA256 d5e17f9d5ba63d4360c66ad9b5633a0ca3c0f3573f4ddb357aee380ab317bb18
- MD5 a348a3bf079fd6a36260ea0282a754f0
- SHA1 13c9808e39e31685731ece57639e587e705f89f3
- SHA512 c322d4df333f2d6f6d14d6d444fce579879a2c3ab54ba0286928d1ddeda3635fc1d9f89d02b34aa1098332a4099cf536e519ea7840b130a41475e5aa8700b723
- SSDEEP 768:0+ycDQYITdZ++eH3A4nzaYHhGifG1yRrH+K8T:0+yUQYc2beTK8T
- TLSH
  T121B2958E967912789573633EAF1F4618FB32122F11059A273AFD85814F7141282A7FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app/js/block_inputs.js
- Size 789B
- SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
- MD5 b5b52c92b90f4283a761cb8a40860c75
- SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
- SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
- TLSH
  T14301D2D864D3A87A597DA328536BE748F7391964905A1054F0DC8C64BAF003BC16EDFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app/js/libs/cmp.bundle.js
- Size 391KB
- SHA256 039d5d4e442cc360b6f54923c53cba5432d80727b8d614a3ee99f7c70307bcae
- MD5 48ccfc31db67a9e9d6decd5b18df96f3
- SHA1 2086877b894bd0ddec2ae80dd853e47fcbdc638d
- SHA512 e369682bbba708ea66797024bc2885e85a4e2b4ac6a4005cc648a7a81d8a4b1c3691c5484408bbd847c40ee80d12e72c5d9722950da020b284843c10d05d0963
- SSDEEP 3072:iyUYM9z8F+GxPMqbOISP88WEAtvgnnhLCVJkNO7Z6BEFltnxKg8rq0gU:LrF+GxPQWEDLmkNO7Z6BAly
- TLSH
  T13D842B8D7991B0E617D722F1802F900BF33A6458784CC490B660D8F1ADF96AD927BF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
- Size 90KB
- SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
- MD5 44e3f0db3e4ab6fedc5758c05cf27591
- SHA1 2d408aa1d35661019c95adcc60b78c0727ed25b4
- SHA512 4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc
- SSDEEP 1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKuQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0JFV:OGsKYAI2p0WP9bDrJ7fak
- TLSH
  T1D493F8DDB2D1B06257BB21BD006F540FF236195D280D8850F129E8EABC74A499277FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $PLUGINSDIR/app/js/models/notifications.js
- Size 5KB
- SHA256 c32495d55eed52f47dc7268eeccb90fb6bdc5686135ed089416c6bb8f703a578
- MD5 911451f65b2503d23bc27c6a6aa6af72
- SHA1 01d3654b23ef7f5adeb4097bd851e8c100a7b2ab
- SHA512 06edaebb0bb2980a7b6d6baa31a9c0894a9bb5f14a91468ffb8f182d98f04bb811df2a4c37f0b56d612603528aa21f390eaa7cf885874ae770a24dce2f9b249c
- SSDEEP 96:sOr8u1s9FHYYdfHsW/GZwzpJGf8mui+U8QrGjqTxoOxoYsdfHsW/GZwvpZGNjINU:sGu9GYl3rNQ8K+JQC+N5Rsl3rxeEYIo
- TLSH
  T1F5C1AB5F90BA00A7057293A819370342FA5753AF49408CAF737C5EB40F311A6B4E5EDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $PLUGINSDIR/app/js/utils/analytics.js
- Size 5KB
- SHA256 0a3b80a0263691f71e85ec681be87229e6325a7d173ff430bbf4eb7fa355476c
- MD5 52b20797b4568fd9eaa065d676b7a344
- SHA1 a14cb0b575f2a7d274a78093d74906351b603dfa
- SHA512 f99786edcfc0220f1563617f40441f9b0ff02083be2c1847677b6533f7d1de16911227e349fe41e328800230bc2994b70db3ab79e4acef5fe07631e87aad0c5f
- SSDEEP 96:LlYkmHqqVHlnZrJGvt+QP2EZc8kukLQsO2LT+gObNSPgPgzauV:AHqSGV+kC9zNObNSPvzaA
- TLSH
  T1A9C199292469719068B373B68F5B1518EBB116233144E9223BBE87415FF6D02C693FCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/app/js/utils/commands.js
- Size 15KB
- SHA256 160ca35f80aeae58f6723c37cdd3e52cbb4ef56e659fbe105a8edab1f0f35ace
- MD5 ccfc18e42871f7eb701c54bc1833dcfc
- SHA1 7da62247f4383148109c198aee1e26c21484104c
- SHA512 f6a08520790106482faf6345ab534210f14e8b5629880f875af8f4210a3d1b7efb24e05dbeed895e2044034a6d535a4b4cc2dae34f5b15e7c4960806c2d0340a
- SSDEEP 384:2Ur5Hs8cD+1uUPULQq06WCHp7GvvoWqEWOnvsUmd:2MwGUd
- TLSH
  T1C872EBAA68A721651933B73DDB9B0215FB33083B11465C147EED46917FF6402C2A6FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/app/js/utils/cookies.js
- Size 1KB
- SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
- MD5 6c60e675f8c8c68c0174b644d3a63a2a
- SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
- SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
- TLSH
  T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $PLUGINSDIR/app/js/utils/modal-events-delegate.js
- Size 1KB
- SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
- MD5 117e4fdbdb0ecf211c8bd909efd337d1
- SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
- SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
- TLSH
  T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $PLUGINSDIR/app/js/utils/strings-loader.js
- Size 5KB
- SHA256 9b833f9e058ddb31ada44764449fe030f05e241dcefdef46886a74e30cd04ba5
- MD5 8ac781fa72423fc5c4c21a8c4138b709
- SHA1 50ad1d7f383d6801c57f916e46c1c17f79222725
- SHA512 f78558488968b1151b189545294a0bb97131c0a4d5dc0fa61ef168d999151e0f12af271389aae985d129adacfc6bf610b0191fb912ffdf8e97283829e2802604
- SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6Wfwk0lx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6WGe0muXDK0W
- TLSH
  T132B1ED58289354118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/app/js/utils/utils.js
- Size 118B
- SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
- MD5 a0952ebeab701c05c75710c33d725e7e
- SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
- SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
- TLSH
  T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/app/js/windows/cri/cri-controller.js
- Size 5KB
- SHA256 8c8c3097f0b587d715e051f55894d73a0fb7b441024f47512fa340eb3f692152
- MD5 344b079e423000460dbcc623d3dea42f
- SHA1 6f7a6db5cdf0e4c511ae1ec8aa1f08dd9e79190c
- SHA512 15358d30f96ba6ec330417896ccd5c837e71b1712357185d7d84e60e8e6c21af52eadc1fcf61f6ce9a79165fab94813370a5ef0b632742043355ae3eb7eb6856
- SSDEEP 96:u6CeVFfOhETv5T6ToY/aq4bCWCtoQNxcGyUkeErscwn:u6jVtOyl2EY/aLmWCyQNxaUkrscwn
- TLSH
  T1BAC1DC9C7CF9866058B7277BCF160518E732420722426A2B7AFE83404FF5E404A16FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $PLUGINSDIR/app/js/windows/cri/template.js
- Size 1KB
- SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
- MD5 2f82acef2d339db31fab5c73edf8af19
- SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
- SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
- TLSH
  T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32