fabe13a339f9bc0679aa7370646e705946b2843765e49f943e0e5eb2bcd25b59

Sharing

Copy URL Twitter E-mail

General

Target
Luxury Shield v18.9.0.zip
Size 15.3MB
Sample260808-jcfphsbn5t
SHA256 fabe13a339f9bc0679aa7370646e705946b2843765e49f943e0e5eb2bcd25b59
MD5 0406fcae10aa4eaa2491816cee264f47
SHA1 f576717996bb42b0d290a2c2e4fcb71684d03718
SHA512 5bf55d2bd2acbf25d3b36d94b50eaeef7cad02164a67031b0445c4d35a96978588f22f00bca606e9482a786bd4746f0d08f1a86c30fc3dae90cab537eed2420a
SSDEEP 393216:9/HGzqhmD6bYdNoXgarmSfvfir+2Bz5AdOyvkT32bJG4ndyW:9/mzqQD6bYd6trmSfvi+mdAd3M2bJ3H
TLSH
T1ABF6338789FEA3851AB4210A17D59CFB671EBE0C634038B4D8D8D76E31B938C15E56B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Luxury Shield v18.9.0/DNGRTx64.dll
- Size 5.3MB
- SHA256 ddeb3041ff32da6d6a98e90941ec18f45b7a8afb2b738394de3073d774dfde4a
- MD5 a428c3e775add87c7915381a88061888
- SHA1 aaf1ef5d8924e92961bf81d07c2d6886e1e01585
- SHA512 29f8d8787e41370e0373bd01021783190fb752f6b37881462ebf7edd9bda9f530f59c125c3ca1ba8f88dde1200a3015868eaf718a9ad09ffc2ad6396a0f098d1
- SSDEEP 98304:yTPCS2FAxDgcE2WT6GFmtMImE2g5gKU/eh8ZnPbLMvlllmUjTF3WlN/vd:hcD7mCtXmpd/egPbLMvXQ+GlBd
- TLSH
  T1C94622ED6144334CD41EC5349933FD09B2BA542E0BD6A9FEB2DB6BD0B79E014DA42B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Luxury Shield v18.9.0/DNGRTx86.dll
- Size 1.2MB
- SHA256 5e97b1088fb36b687c19f1661e43b13b9bebe233fe2543f66e8b2f8ab07b891b
- MD5 a8a0481e38db76b75c4c61529e479b5f
- SHA1 f2c406eb3799bac9def8a96acd9ca68b9f1f6ffb
- SHA512 bfff222fae902dfac61e2cc36e34dacffeaaaae1c6a39e779c2f85f2ac956fda7e8f9e973e0b3773b2bbfa7ed1dd00e9d1fa4516cc50225a00fea1d6dd1cd09e
- SSDEEP 24576:aDb02iQ069HOuZUTzao7PRTCB657SRBJP4YLhxdYqCrCmlRR2+Vr:2oo9uyOZPRTI69SRBJhhbYsml
- TLSH
  T1164533DB9A05A2D8D8F1A87DA7C5AD7386F8C08E4357D86E4942C9BD73320143B385BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  Luxury Shield v18.9.0/ILMerge.exe
- Size 668KB
- SHA256 8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd
- MD5 2bb6322885e6ca0986206de174e842c9
- SHA1 c5ea70169106d32bc513d28ea76ae8ea1e49380b
- SHA512 9750180c54a5bd8f0e1fa8a8f529364430f2ef444efbf8ac51e8d2a0aaa4e3d21fe553865ba8567c7c19e4ae84d04b20464f391743e88c52c00cac0bf20fc2a7
- SSDEEP 12288:8E8Q+HlWx+TV7109nrRoTQhfL40+FQT7gWoi:hn+HQp9UQ2dFNi
- TLSH
  T111E44B107FE4D617D1BA87B2A8B3091457FCE046F357EB8F59806AE91C03741AD262BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Luxury Shield v18.9.0/Luxury Crypter.exe
- Size 8.8MB
- SHA256 1454f76153641a5065dde7f5cd4ded43d86a643177d421e6239f0045b0a093cd
- MD5 5bfe693ca3d590de2d262348775c50e9
- SHA1 98c80fa291f01ef2afbe0b46bba11a09253a33fb
- SHA512 4e5ac61a7345257a5407234f4bdb8af86a5097415ec3b917f1bc4fa90dd87d1c283c8e3dcdc4742bf9e148b64f4d69d8dff353f7486b84867cc4d370cb3bac8d
- SSDEEP 196608:fReG3+fWT1RncbvhNmeBjgeGpXxGGbmTL3RVmEM1I2G8hQE2v:Ek3TzcL6eBjNiXEGbYj/S15GWF
- TLSH
  T1949633597B59F9D9CBA80F3CC5A4C4EBEB682CD62F00962F7CB070D414B728A7816563
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

costura discovery packer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  Luxury Shield v18.9.0/Patch.exe
- Size 441KB
- SHA256 4a42534a306ffb3f4a84b37cee256495b206d3960056f41c9d18516a0f18de90
- MD5 ab7afbe5613dc7807e61435ebdea7e50
- SHA1 5e96df26d1f44a445cc89b9bc78dc458443553db
- SHA512 72646e576b3c1a01edae6910546df41ca8e5a421d628ff836edae97e104d09a67b4a79b729d5e906db65ba6ccea00038a0a8fd0d5badea6c639a064ffeae6047
- SSDEEP 12288:fSRXYWwrqxpzaXs3NelvdII20JK+auFeTVx:mwzQAvd/20c+RIVx
- TLSH
  T1A4A4CF1E19E7D45AC3DB4275D083C080DBB3D9F2E457D3BB641825F7EA21F9A880663A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

costura discovery execution packer defense_evasion spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Badlisted process makes network request

Checks computer location settings

Executes a VBScript file via the Windows Script Host.

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10