luna_stealer | eeb5217062da7bd5faaee1c6c5858926e0ea23d5400677b866824d7e1d839313

General

Target
2026-07-27_ba7ed4d9e4096473429645998d393cca_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 19.5MB
Sample260727-d9215agn6v
SHA256 eeb5217062da7bd5faaee1c6c5858926e0ea23d5400677b866824d7e1d839313
MD5 ba7ed4d9e4096473429645998d393cca
SHA1 119b89cdc7e83bc5b6c51a237871cd971495c778
SHA512 9629053488778ee014734caf03d238ebd6b13f65ae70995acaebcdfcf8cd290021896f22dd2906714ef0ecade80aeb1747ff1be7009916f1609a05ddfe05d895
SSDEEP 393216:pv9zcQqqPny5+Z0SAaJ+c/pWFwRQru3HBJeZWdp9N5DHTy:l9gQfPny5+Z0ShJ+c/pW1ruxSO1z
TLSH
T1BA27338E73B105E1E4D26976D006DAB48271FC914B74EB9EC3681AAD1F87650283FFE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-27_ba7ed4d9e4096473429645998d393cca_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 19.5MB
- SHA256 eeb5217062da7bd5faaee1c6c5858926e0ea23d5400677b866824d7e1d839313
- MD5 ba7ed4d9e4096473429645998d393cca
- SHA1 119b89cdc7e83bc5b6c51a237871cd971495c778
- SHA512 9629053488778ee014734caf03d238ebd6b13f65ae70995acaebcdfcf8cd290021896f22dd2906714ef0ecade80aeb1747ff1be7009916f1609a05ddfe05d895
- SSDEEP 393216:pv9zcQqqPny5+Z0SAaJ+c/pWFwRQru3HBJeZWdp9N5DHTy:l9gQfPny5+Z0ShJ+c/pW1ruxSO1z
- TLSH
  T1BA27338E73B105E1E4D26976D006DAB48271FC914B74EB9EC3681AAD1F87650283FFE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution luna_stealer persistence privilege_escalation spyware stealer upx
- Family: LunaStealer
  LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
  stealer luna_stealer
- LunaStealer is a stealer written in Python and packaged with Pyinstaller
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2