luna_stealer | 0baeb1297c62f23c48d1219c22b9e10d00c2824701c761663ffc5b3adf657f2d

Sharing

General

Target
Luna-Grabber-Private-main.zip
Size 8.9MB
Sample260804-df4b4aca42
SHA256 0baeb1297c62f23c48d1219c22b9e10d00c2824701c761663ffc5b3adf657f2d
MD5 961d333c3765ec269f454ee0104c0ea3
SHA1 abc66ec9233fafedf621802626e88fe655f6e510
SHA512 ec0b6c0eeacd7c5144ec1e450b64024d961b8540df27907de8806f79fec869fd7ba74d46b0abc97b5372aa979a01767f19020d50d88c979cec0c9743a11ce3a3
SSDEEP 196608:QCbpL7W7c0wGeiEsXK7N3ucpkq6bztyWxHDZ7nmu5n+z7hhN:FbpWTeOXKR3nplOhyWxH9n7+z7/N
TLSH
T1B8963384401BB58B9CA4F13E4867D3DB876A50B7DA4743BB9262D13B1ECBF929C5C087
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v15.5.4 | SeroXen

DESKTOP-GL2DPAG:443
46.135.97.12:443

Mutex

c5a535f8-90d1-46ae-b22a-dc66adff5d28

Attributes

encryption_key
D7B29E6619CF8381517F81F786DED591F40C3DCD
install_name
.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
$sxr-Logs
reconnect_delay
3000
startup_key
$sxr-seroxen

Targets

- Target
  Luna-Grabber-Private-main/luna.py
- Size 51KB
- SHA256 9fe3a190f39327c1f2d817d91db647620e9d3d5a5c4f914feb66ef5f52b2a76f
- MD5 a567679e2c533b12b73d83841db5aa7e
- SHA1 155cca01b48c1b9aab9ed19bc1d88a197270d1e8
- SHA512 97f46a405dcb5eecca37955f8f720cbf2b1dcc7bae11dfe23de3b31f5a5efb18d4609e0fbdeeb3e46e08c7732c599cf2db9ff4088bb1ce5f6e8edd83b9e0b10b
- SSDEEP 768:9lCvfeSqFEIxK4R464G87zIC4hJ+2JyjWsGDT8D79Rz1txlc:94vfeSwKQGMJyjWxDT8D7Ntxlc
- TLSH
  T1DD33EA15CC6B141191B6869EA413F84BFF09A343C22A15037EBCD3847FB9556D2E8EBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Luna-Grabber-Private-main/run.bat
- Size 37B
- SHA256 549304f2b20cf1cca4238be797fe738a1ab2992c65a22af6a03313790230c9d5
- MD5 fb0f3e8f45fdd2b9ddad038f59f2c4c2
- SHA1 8f4552ad25126e88d28dc65fa49a91ba389fc229
- SHA512 594fdc8e605c71c092c80ca8eefa50c750fa05e75b6dba0b9dc97ac618d432845acdf1e88b989d096c243ace38f6fb5e66139965fdf83dc7e9286f106ad9c9a7
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Luna-Grabber-Private-main/setup.bat
- Size 13.2MB
- SHA256 0f57fa2dc5322daa1041b1afb474f120c8a1f9043654eb2385572f2735f647ee
- MD5 12d54bda14f1f3f859cd683d575cd45c
- SHA1 8ba68100f6249f87ff9cd8eddf20605197cb84f0
- SHA512 1b339ff0851d415c86fbd672e6b12a40b96e1f27fd4f5ad14634a9d1ecc4214fc554924f9fb2b7114209a9c85d77b38891d24d157ae7dc1f7b19d09a9880b3db
- SSDEEP 49152:FO6fBUAS7yZCyDKLx69x9kEYbUJcIPNlqLk9NiPxR0pgiDxD/pe3EnDYp7Nmf9RJ:R
- TLSH
  T19CD6AE320308FA5E51662F7B480AA83761B54666F18BC0AFD415F3C0BA6FDA37F54C99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit v15.5.4 | seroxen costura defense_evasion discovery execution quasar seroxen packer persistence spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Family: Seroxen, Ser0xen
  Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
  trojan seroxen
- Quasar payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft NirCmd
  NirCmd is a lightweight Windows command-line tool for automating system tasks
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  Luna-Grabber-Private-main/tools/obfuscation.py
- Size 5KB
- SHA256 5c16acaa25fc6faa1f908fcc16ec8cb1ae06c0123c8a62361acd14d7231bda6a
- MD5 048c8c48381b79889e31813ca2862d1c
- SHA1 b8f751e462c402717e930e35449754876bece5da
- SHA512 0dcd9ca7b21e7ee4d55098eeffbbe52919dde63bfaf1175f12cb22cb92c3fb25186dcdc48104d704c559011c6b1b3d99ba8a559ee8f09ad5f3a984db6548404a
- SSDEEP 96:WFJezcDqzXP4oL4dsJPuCLI/5xgE5onIpnGuQXcu:WFmXAdsXI/5BoIp58cu
- TLSH
  T198C121628CA61CF129379A0C9D6BD427D76E876B62384252FCFC63D16F304A1C4B5CE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Luna-Grabber-Private-main/tools/update.py
- Size 2KB
- SHA256 2fd77556cfe66f9f45f4e984dc73b382f60499f8cc65dfd33e0ecd29b1d6e1e7
- MD5 19b326d61c189d2f81420d27fbd6cc16
- SHA1 4b90254466163d9b2344308f54bd9ed36840fd8c
- SHA512 d6451c787c5193f680071d4fd0c935592784d5054badf7f0cd703b7c766f05ed18e05e5f2c3328fe113abec8e06fe0f4528ae4a1d7da09f2bde9d07b18b480dd
- TLSH
  T14251DF72A4007329036E8D4914B5FCAD17262CE6CA36B024F4EE96C16F3AD70CD99DD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Luna-Grabber-Private-main/tools/upx.py
- Size 843B
- SHA256 3100e615d0a1bb235e18b30fc2f0974e7fa02d8c9beaf6d0550e35805e2d3edb
- MD5 76efb2a3ae61d0e41f069272fb783cc9
- SHA1 93543bf44215c5bd59d6ece18d435e34c4847598
- SHA512 68f6f2348940408198b28739448a1c0bbc6c541ef9e1226645c78fa6ef469a23efeb11188f51c350a68bdf039d0d62e9b26d3160f9324cf6981585332dfdb7cd
- TLSH
  T1F0019C8664C2D6109397DB65889398172A47BD03AD4CA06039FD25EAEF381B680C39D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12