luna_stealer | 6668596c3b5b6ee681bf6b391eebcbf9eac30c5134c6986402f247094b40422d

General

Target
2026-07-22_a133d78f563fdd25ba1e692e2ac6da8c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 21.4MB
Sample260722-vwky5azekd
SHA256 6668596c3b5b6ee681bf6b391eebcbf9eac30c5134c6986402f247094b40422d
MD5 a133d78f563fdd25ba1e692e2ac6da8c
SHA1 2f3e9025d5dac2b55b0e40539abd6e86294c520e
SHA512 39ef03ca67b2f63575c7ca79f0d5b5d333bf12d1affe8f1f4eff471a4a29aa91d6cbd510bb9d85a470bdba34981f0f12400914a084757b22b904bbe7fec8e9f2
SSDEEP 196608:gxGOLr9GwWb0sKYu/PaQdXGn9D4V5zhL9aeNdBFJMIDJD5WgsAGK4R08FKFG6H2n:ohMwMQdXGCZRPnFqywgstRxhZYIQJ0D
TLSH
T17F373370666A14E1F5E9923B484FC81A46607D0217B0E6DF436CA72D4EB32656E3FFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-22_a133d78f563fdd25ba1e692e2ac6da8c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 21.4MB
- SHA256 6668596c3b5b6ee681bf6b391eebcbf9eac30c5134c6986402f247094b40422d
- MD5 a133d78f563fdd25ba1e692e2ac6da8c
- SHA1 2f3e9025d5dac2b55b0e40539abd6e86294c520e
- SHA512 39ef03ca67b2f63575c7ca79f0d5b5d333bf12d1affe8f1f4eff471a4a29aa91d6cbd510bb9d85a470bdba34981f0f12400914a084757b22b904bbe7fec8e9f2
- SSDEEP 196608:gxGOLr9GwWb0sKYu/PaQdXGn9D4V5zhL9aeNdBFJMIDJD5WgsAGK4R08FKFG6H2n:ohMwMQdXGCZRPnFqywgstRxhZYIQJ0D
- TLSH
  T17F373370666A14E1F5E9923B484FC81A46607D0217B0E6DF436CA72D4EB32656E3FFE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution luna_stealer persistence privilege_escalation spyware stealer upx
- Family: LunaStealer
  LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
  stealer luna_stealer
- LunaStealer is a stealer written in Python and packaged with Pyinstaller
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Drops startup file
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2