luna_stealer | 2023a614b35f49aaca289d8eef060d87fce740740650ed3ba0b926ad58e77a95

General

Target
2026-08-20_2901714808437e3745e27a5fd42d35f2_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 23.0MB
Sample260820-mag2caal2t
SHA256 2023a614b35f49aaca289d8eef060d87fce740740650ed3ba0b926ad58e77a95
MD5 2901714808437e3745e27a5fd42d35f2
SHA1 c89a5a2d651a78c95a202e0f78481f4dab441ebd
SHA512 12fd64f1dd2144d95ecc39871546c2717e6f04e666990856d996801b615ffa737e494ffb8b21268eeb0257bce266b39e3cfe43e3900ebe76d40b5a2e5df6ad6f
SSDEEP 393216:TtSdk/TSGTWN26WUBnwkAjTtYFxVHFFmuC9hHTodRGkXhVIfFLKRDAggdUEQN:hSW7426WUBn4dYFrHFF7CX0LhXcfFSBh
TLSH
T17B37332A66E48A75F9D3E1395213C584F736B8828331DBAF17ECD5513E3B4B40931EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_2901714808437e3745e27a5fd42d35f2_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 23.0MB
- SHA256 2023a614b35f49aaca289d8eef060d87fce740740650ed3ba0b926ad58e77a95
- MD5 2901714808437e3745e27a5fd42d35f2
- SHA1 c89a5a2d651a78c95a202e0f78481f4dab441ebd
- SHA512 12fd64f1dd2144d95ecc39871546c2717e6f04e666990856d996801b615ffa737e494ffb8b21268eeb0257bce266b39e3cfe43e3900ebe76d40b5a2e5df6ad6f
- SSDEEP 393216:TtSdk/TSGTWN26WUBnwkAjTtYFxVHFFmuC9hHTodRGkXhVIfFLKRDAggdUEQN:hSW7426WUBn4dYFrHFF7CX0LhXcfFSBh
- TLSH
  T17B37332A66E48A75F9D3E1395213C584F736B8828331DBAF17ECD5513E3B4B40931EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2