1b0f8ca349a4546305ee8b8d71740caa301ded31280b64e329c088acde388b07

Sharing

Copy URL Twitter E-mail

General

Target
Lunar Client - Installer.exe
Size 3.1MB
Sample260807-qnfbfsen5v
SHA256 1b0f8ca349a4546305ee8b8d71740caa301ded31280b64e329c088acde388b07
MD5 80ff1e28350478f684e80539133828b8
SHA1 a2c6a5fcb86d7cb8d85211a23fee585807e50072
SHA512 411600807052094bee82abbed3706844ad69c228811706e3a31e46d7b4ab8bcdcb38bc475a4a0889e5049f3a0f95a93c4b94ba97d48960ca89daf73a552a8514
SSDEEP 49152:lmAgwYwxE87vxpsrFpIvQ4kvoHch90kYssYEXHIw3UhsooAFhR8MSh9YHzcYq:lhBPN+TIvrWccYvyoHrkhsbc8MyYT
TLSH
T116E523E4B820CC3DE6310EF9B6F5C05AE7B88D39682945897761B5853E32E4EDD0782D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Lunar Client - Installer.exe
- Size 3.1MB
- SHA256 1b0f8ca349a4546305ee8b8d71740caa301ded31280b64e329c088acde388b07
- MD5 80ff1e28350478f684e80539133828b8
- SHA1 a2c6a5fcb86d7cb8d85211a23fee585807e50072
- SHA512 411600807052094bee82abbed3706844ad69c228811706e3a31e46d7b4ab8bcdcb38bc475a4a0889e5049f3a0f95a93c4b94ba97d48960ca89daf73a552a8514
- SSDEEP 49152:lmAgwYwxE87vxpsrFpIvQ4kvoHch90kYssYEXHIw3UhsooAFhR8MSh9YHzcYq:lhBPN+TIvrWccYvyoHrkhsbc8MyYT
- TLSH
  T116E523E4B820CC3DE6310EF9B6F5C05AE7B88D39682945897761B5853E32E4EDD0782D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/app/cmp.html
- Size 5KB
- SHA256 5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c
- MD5 17241946e51074e6877c43737b94ad71
- SHA1 16918c53471fe3f35fcae1e9902870d91c50d957
- SHA512 b4b6e030fd1abe19fa308b32f04571a7c1c1f78a7cb789f169b37b54f281ec66d16e4cf0bbbdad81642bf28e266a6b2af7c19cf5106c683fb7f443bfa3110e05
- SSDEEP 48:tZrc0/GdshWpo1rckthAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4Li1:4V+8v4jHa2NGiivmmpWsBVuQFwlE5vSG
- TLSH
  T15DB1DB1A2D5914A80077E3385B6B6208F72AA1B72105CA067EACDE513FB152BD58FFCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/app/index.html
- Size 27KB
- SHA256 f3a33ad0c5dcdbba535684fc8f6f8514cc144bea144f099f48e632e724f76eba
- MD5 2d53b20d968ed838e92efec419fb03f1
- SHA1 c12bb51b851e94bd28c35a88e4796da33452199f
- SHA512 66e2794754798183109d69097ea9d11cff7fa9d545cd230d03cead441a4bb47d0d23b74a85c3286b21cd9ad734042042e5284f438af1c4ac3ddeb46882cb77fb
- SSDEEP 384:vN7Y6FCs5XRJ/seq06IfLglbyMaAt1vnE++ggevsu5SwU:z5XX/seq06IfLglbyMai5n30u0wU
- TLSH
  T167C2A611DA36202DB137462A75E2BA5D3034C117E5639A7EFA5C9674CBCB18B1F23B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app/js/app.js
- Size 24KB
- SHA256 d5e17f9d5ba63d4360c66ad9b5633a0ca3c0f3573f4ddb357aee380ab317bb18
- MD5 a348a3bf079fd6a36260ea0282a754f0
- SHA1 13c9808e39e31685731ece57639e587e705f89f3
- SHA512 c322d4df333f2d6f6d14d6d444fce579879a2c3ab54ba0286928d1ddeda3635fc1d9f89d02b34aa1098332a4099cf536e519ea7840b130a41475e5aa8700b723
- SSDEEP 768:0+ycDQYITdZ++eH3A4nzaYHhGifG1yRrH+K8T:0+yUQYc2beTK8T
- TLSH
  T121B2958E967912789573633EAF1F4618FB32122F11059A273AFD85814F7141282A7FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app/js/block_inputs.js
- Size 789B
- SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
- MD5 b5b52c92b90f4283a761cb8a40860c75
- SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
- SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
- TLSH
  T14301D2D864D3A87A597DA328536BE748F7391964905A1054F0DC8C64BAF003BC16EDFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app/js/libs/cmp.bundle.js
- Size 391KB
- SHA256 039d5d4e442cc360b6f54923c53cba5432d80727b8d614a3ee99f7c70307bcae
- MD5 48ccfc31db67a9e9d6decd5b18df96f3
- SHA1 2086877b894bd0ddec2ae80dd853e47fcbdc638d
- SHA512 e369682bbba708ea66797024bc2885e85a4e2b4ac6a4005cc648a7a81d8a4b1c3691c5484408bbd847c40ee80d12e72c5d9722950da020b284843c10d05d0963
- SSDEEP 3072:iyUYM9z8F+GxPMqbOISP88WEAtvgnnhLCVJkNO7Z6BEFltnxKg8rq0gU:LrF+GxPQWEDLmkNO7Z6BAly
- TLSH
  T13D842B8D7991B0E617D722F1802F900BF33A6458784CC490B660D8F1ADF96AD927BF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
- Size 90KB
- SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
- MD5 44e3f0db3e4ab6fedc5758c05cf27591
- SHA1 2d408aa1d35661019c95adcc60b78c0727ed25b4
- SHA512 4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc
- SSDEEP 1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKuQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0JFV:OGsKYAI2p0WP9bDrJ7fak
- TLSH
  T1D493F8DDB2D1B06257BB21BD006F540FF236195D280D8850F129E8EABC74A499277FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $PLUGINSDIR/app/js/models/notifications.js
- Size 5KB
- SHA256 c32495d55eed52f47dc7268eeccb90fb6bdc5686135ed089416c6bb8f703a578
- MD5 911451f65b2503d23bc27c6a6aa6af72
- SHA1 01d3654b23ef7f5adeb4097bd851e8c100a7b2ab
- SHA512 06edaebb0bb2980a7b6d6baa31a9c0894a9bb5f14a91468ffb8f182d98f04bb811df2a4c37f0b56d612603528aa21f390eaa7cf885874ae770a24dce2f9b249c
- SSDEEP 96:sOr8u1s9FHYYdfHsW/GZwzpJGf8mui+U8QrGjqTxoOxoYsdfHsW/GZwvpZGNjINU:sGu9GYl3rNQ8K+JQC+N5Rsl3rxeEYIo
- TLSH
  T1F5C1AB5F90BA00A7057293A819370342FA5753AF49408CAF737C5EB40F311A6B4E5EDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $PLUGINSDIR/app/js/utils/analytics.js
- Size 5KB
- SHA256 0a3b80a0263691f71e85ec681be87229e6325a7d173ff430bbf4eb7fa355476c
- MD5 52b20797b4568fd9eaa065d676b7a344
- SHA1 a14cb0b575f2a7d274a78093d74906351b603dfa
- SHA512 f99786edcfc0220f1563617f40441f9b0ff02083be2c1847677b6533f7d1de16911227e349fe41e328800230bc2994b70db3ab79e4acef5fe07631e87aad0c5f
- SSDEEP 96:LlYkmHqqVHlnZrJGvt+QP2EZc8kukLQsO2LT+gObNSPgPgzauV:AHqSGV+kC9zNObNSPvzaA
- TLSH
  T1A9C199292469719068B373B68F5B1518EBB116233144E9223BBE87415FF6D02C693FCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/app/js/utils/commands.js
- Size 15KB
- SHA256 160ca35f80aeae58f6723c37cdd3e52cbb4ef56e659fbe105a8edab1f0f35ace
- MD5 ccfc18e42871f7eb701c54bc1833dcfc
- SHA1 7da62247f4383148109c198aee1e26c21484104c
- SHA512 f6a08520790106482faf6345ab534210f14e8b5629880f875af8f4210a3d1b7efb24e05dbeed895e2044034a6d535a4b4cc2dae34f5b15e7c4960806c2d0340a
- SSDEEP 384:2Ur5Hs8cD+1uUPULQq06WCHp7GvvoWqEWOnvsUmd:2MwGUd
- TLSH
  T1C872EBAA68A721651933B73DDB9B0215FB33083B11465C147EED46917FF6402C2A6FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/app/js/utils/cookies.js
- Size 1KB
- SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
- MD5 6c60e675f8c8c68c0174b644d3a63a2a
- SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
- SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
- TLSH
  T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $PLUGINSDIR/app/js/utils/modal-events-delegate.js
- Size 1KB
- SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
- MD5 117e4fdbdb0ecf211c8bd909efd337d1
- SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
- SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
- TLSH
  T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $PLUGINSDIR/app/js/utils/strings-loader.js
- Size 5KB
- SHA256 9b833f9e058ddb31ada44764449fe030f05e241dcefdef46886a74e30cd04ba5
- MD5 8ac781fa72423fc5c4c21a8c4138b709
- SHA1 50ad1d7f383d6801c57f916e46c1c17f79222725
- SHA512 f78558488968b1151b189545294a0bb97131c0a4d5dc0fa61ef168d999151e0f12af271389aae985d129adacfc6bf610b0191fb912ffdf8e97283829e2802604
- SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6Wfwk0lx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6WGe0muXDK0W
- TLSH
  T132B1ED58289354118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/app/js/utils/utils.js
- Size 118B
- SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
- MD5 a0952ebeab701c05c75710c33d725e7e
- SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
- SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
- TLSH
  T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/app/js/windows/cri/cri-controller.js
- Size 5KB
- SHA256 8c8c3097f0b587d715e051f55894d73a0fb7b441024f47512fa340eb3f692152
- MD5 344b079e423000460dbcc623d3dea42f
- SHA1 6f7a6db5cdf0e4c511ae1ec8aa1f08dd9e79190c
- SHA512 15358d30f96ba6ec330417896ccd5c837e71b1712357185d7d84e60e8e6c21af52eadc1fcf61f6ce9a79165fab94813370a5ef0b632742043355ae3eb7eb6856
- SSDEEP 96:u6CeVFfOhETv5T6ToY/aq4bCWCtoQNxcGyUkeErscwn:u6jVtOyl2EY/aLmWCyQNxaUkrscwn
- TLSH
  T1BAC1DC9C7CF9866058B7277BCF160518E732420722426A2B7AFE83404FF5E404A16FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $PLUGINSDIR/app/js/windows/cri/template.js
- Size 1KB
- SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
- MD5 2f82acef2d339db31fab5c73edf8af19
- SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
- SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
- TLSH
  T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Network Share Discovery

Checks computer location settings

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32