74ec81cf520890078e131167ee155ed9eb40ddea15fbe2589ade3a5c31a2a624

Sharing

Copy URL Twitter E-mail

General

Target
LuminApp Setup 0.2.4.exe
Size 136.9MB
Sample260818-2pn6jaam2w
SHA256 74ec81cf520890078e131167ee155ed9eb40ddea15fbe2589ade3a5c31a2a624
MD5 7ffc5393340fe9a60eadb35ee3fcf30b
SHA1 8307fb67b35af650aaf123c44bcc46bcb61278ad
SHA512 e451207cb963c032639a73e9c11e3350b6acbcfcc619d56e3978ca7c81252e9003030e1ab8a587540fea6fe35881176bb746100a42b710f0cf8949ee2e97c32d
SSDEEP 3145728:TduZEcbEWhFRyViEwYLR7v1FUMFke799b1BiMYqzzU:kqBWzRXYNoeb1W
TLSH
T1096833E64351B652E1AC4ABE02520FEC669D30DB8F910F2CCA5403E97B5703BBF58796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LuminApp Setup 0.2.4.exe
- Size 136.9MB
- SHA256 74ec81cf520890078e131167ee155ed9eb40ddea15fbe2589ade3a5c31a2a624
- MD5 7ffc5393340fe9a60eadb35ee3fcf30b
- SHA1 8307fb67b35af650aaf123c44bcc46bcb61278ad
- SHA512 e451207cb963c032639a73e9c11e3350b6acbcfcc619d56e3978ca7c81252e9003030e1ab8a587540fea6fe35881176bb746100a42b710f0cf8949ee2e97c32d
- SSDEEP 3145728:TduZEcbEWhFRyViEwYLR7v1FUMFke799b1BiMYqzzU:kqBWzRXYNoeb1W
- TLSH
  T1096833E64351B652E1AC4ABE02520FEC669D30DB8F910F2CCA5403E97B5703BBF58796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/libre-hardware-monitor/System.Security.AccessControl.dll
- Size 35KB
- SHA256 ff14c5f628b9a6798d173aefbba0a43d61e66f715108e2576ac0d3dfab9071d0
- MD5 527595c86ad17045a101d567d7d3279f
- SHA1 83014e2a98f7597b9a26e424a0759e5a3d2ecff1
- SHA512 9ebaaca1623bc8e2fc8df158f338b5e415670fa53e212bb38771e7e25af9688301cc4aee055c5b64e33f8aa24729ed896e0be8e2dbce54386583c660476c5dda
- SSDEEP 384:zdlIF91FhktexyvaMAdB+w3G5h9MF4YfzMfpcrqmf9wEJqIxVRvFNgfBkyN17xWI:ZlM7Ke5/WBkyN1hhMPS
- TLSH
  T157F2E602A7FC1229FFBB0BB07E7999151D7BBAD63D12C50D1155910E19A2FC0DAB1B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/libre-hardware-monitor/System.Security.Principal.Windows.dll
- Size 17KB
- SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
- MD5 be2962225b441cc23575456f32a9cf6a
- SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
- SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
- SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
- TLSH
  T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/libre-hardware-monitor/System.Text.Encodings.Web.dll
- Size 85KB
- SHA256 43e6dfb4aa333848be5066dcb3d490afc417d0f896aada2f17b5db5fcbb819fc
- MD5 2886fb6ea404d600f7fcf34dc4f7b3b8
- SHA1 e54eb962cb3ac8e778b2648b8f5670eb9b1915b5
- SHA512 e05347c2abb577ddf217b8b6b71cd1ec7084164b5ae920a420fc937888e4b972ae49111c069c61e03dcb5593d0b3f674229273251f82ee73c22ad7d0c96d9791
- SSDEEP 1536:wYQU6qF6FmUroWpn5qTQlyydbrkSycICopK65B21MvI7za:wYcqwTrfgQlTBrWclopTm+
- TLSH
  T1AB836C12EF9C862AFE5E013A5CE090659B74EF971133EBD73859792916333C4620DAE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/libre-hardware-monitor/System.Text.Json.dll
- Size 760KB
- SHA256 7a7f2e0b942782739551b37546efc842f53c7fce3a8f0f56ad45a5cf78e2c214
- MD5 82044c0f69679b28bb06c97ae31f31b5
- SHA1 551f618624a09680a11ba5217f63d719499d2610
- SHA512 528c99ae147bd76f51f01242c96dfb0791180f7332365c5e07c9e463cee4bcb08fca16e36ded00052c151b57f1b4f1153ce4050619284f9f44218f2ee71ea7ce
- SSDEEP 6144:mUijbPJXV/2IdelcQTy6fKdHfibTxbsjaq/dliUL5ZFPDnkVOzxQx6aUYMFlsjwR:mVbxFO7lcQTJKd/805/dlcVO+x6tlUS
- TLSH
  T19CF46B20B7E8D72BD6DF4B71B03089148BB1F61967AAE78F618846ED1C927809C453F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/libre-hardware-monitor/System.Threading.AccessControl.dll
- Size 33KB
- SHA256 5e3a3902f04f840c0fc1f9c2f249f804f6cfdf7901b2e06778bc2a4603ae4694
- MD5 1ca69162aac8b779661cf80ea290b7ab
- SHA1 48872ee0e22bb7b883b0d6c4ee941dffceacd821
- SHA512 a104468acf952bc94905bf928ae295a00b7ce3b2bd0b42fd7a850afcfa10d68ff172cbd164d4a09bcc1dcf71e696cba71b8ff9d1ad0b53639f75699adf25aa6f
- SSDEEP 768:IjgJLZG2s9N4SHTf9u/7OTDjawGOrF9z8j2:dJLS9eEoCjayLzG2
- TLSH
  T180F22A22A3FC036AEFB70FB0AA7591551E35F6D32903D29E5185F10E2A67B408A31776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/libre-hardware-monitor/System.Threading.Tasks.Extensions.dll
- Size 27KB
- SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
- MD5 0fff41795a1107691ec1e5054211c04a
- SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
- SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
- SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
- TLSH
  T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/libre-hardware-monitor/de/Microsoft.Win32.TaskScheduler.resources.dll
- Size 9KB
- SHA256 f54e8a38be8e27f178ac519e7eafa613d0341037bd0f723bf128fcdb94b7b540
- MD5 862d5b4278ecde363e96f1cc77bb99a3
- SHA1 fe0bab095851ba56583780bca6f9d5db387bf2be
- SHA512 7b612ad01a61ff00f94a7be36a6ab659dbe034b0a3fced1323d042856fc74bb1bfd16215f37aa15d7b763baaf5595518edf3fe0bc4c82504685b0509c9de63d1
- SSDEEP 192:QiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufA+a1b5rAM0XWr:/1Nvb5adVl8P2djJMZJSGuo+85rAM0Xq
- TLSH
  T113122E09ABF8063DF1F72FB9E9B68631B43AFD968D32D52D1244814C4530A41CAE1B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/libre-hardware-monitor/es/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 b417b6a5b5dc7349122a00c43c06897aedf414046af83ba14ba28838f243ca42
- MD5 689f3297baa8b758d593e4146e8bb8ca
- SHA1 d44bf449503af309ac1dcab363bce9e828be09f5
- SHA512 dfb147fa4b9e1f223864d2a5bc1b927515f218f58257b6fd3988bfde6238e8bae4290e6a0da73dfd59dcc94aaa7dc22247327bfb79180e349080068ef20e3d02
- SSDEEP 192:p3WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAA/a1E5rAM0XWr:Z1NvbGVxx6hUltfxgE00cU/T5rAM0XWr
- TLSH
  T13A221009ABF8463DF4F22FB9E9768132F43AFD959D32C66D4244824C5470A85DAE1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/libre-hardware-monitor/fr/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 4b282ddf1f09e09242ca11a22fd7dfdd069ede751961bdf8d771258071823b51
- MD5 b2bc752b1471034133545dd243d21fe1
- SHA1 2741114bb8c6ef8705d4856e24079783bbdf5734
- SHA512 f2a4967a80fb401413dacadb68843dd13165b8d08cb59abf81120969b0b1ead73e448f4b4902139107a3e2fa66502f440ffc2d7a9ac35bd66764a96ae9722cdc
- SSDEEP 192:ylQRWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VAJa1p5rAM0XWr:ylc1NvbdKJiDjgmlRi0HYZDjJu5rAM06
- TLSH
  T12422100EABF8162DF5F32FBAE9768522F43AFD959C32C5AD0244810D0571A41D6E2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/libre-hardware-monitor/it/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 24a3040b55de26ce6c8f36f60e1d728ead14416875c01d160d9ffcfbeaa8dcd5
- MD5 dba841e066426c4d60b2270050a9f1fc
- SHA1 3bd911fd8c6d01972111997ad35247fecee974f4
- SHA512 620521a2a1550099961764ad04eb8ff299973a098d7ee921e1d47be522e89323714c9e0afc3da4c7a72513b221b2eac1d1bfedb9098f9427e038ddb05730f138
- SSDEEP 192:+vCiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mAu7a1j5rAM0XWr:0R1NvbGTNgr1nJI3+07ju7k5rAM0XWr
- TLSH
  T139220D09ABFC063DF4F36FB9EA768121B97AFD959C22C66D1648810D4470A81D9F1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/libre-hardware-monitor/ja/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 e282404035693502882bca0b88e988fe0bff8ace799ce67582bbb1485751b5dd
- MD5 9c539eb6c89ba9f7c7e7b584498f796d
- SHA1 a08d59f48ac09f1043501ce936c92b9678941c98
- SHA512 6e9e031a287e7562997f127847e8c6bf1c9cb411cd49061e593357729b910ed7df2d301c4e2f1c66bc240fff35d06234ed4415dabd55fcd9604b66037e5eb740
- SSDEEP 192:QiWWNv/jzSE3tKMXdIPJxrDnBRbpsHDeAha105rAM0XWr:Qi1NvbRXdIPJxrDBRmHDLhj5rAM0XWr
- TLSH
  T1B422DA0DA7F80A3DF4F22BB9E97A8121B43AFDA5CD32D62D0608C11D5530A45DAE1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32