b4486ea5d9d2dc954ee5545f082dbcefdf71068e465f91d392b497849f3e1698

Sharing

Copy URL Twitter E-mail

General

Target
Lunar Client - Installer.exe
Size 3.1MB
Sample260827-lz1pbasflh
SHA256 b4486ea5d9d2dc954ee5545f082dbcefdf71068e465f91d392b497849f3e1698
MD5 8b8cba76f898b8586f73f6ea4ed1d9d5
SHA1 41ddca8d5f95978c023c3b1bc6f3f2652b643de2
SHA512 9d76b07b6cc0f9295b230d21507a6d06425df2218f45fee1f3fcc98add2cf1ccf8de58fc445c9e5efb30125efed9e6bf737ff97cae606cdb535eca8ced7ff3dd
SSDEEP 49152:5mAvS9J6xE87vxpsrFpIvQ4kvoHch90kfsFYEXupw3UhsooAFhR8MShqLAEqcY:5heJ8PN+TIvrWccYkHouCkhsbc8M3k
TLSH
T112E523E4B820DC3DE6310EF976F8C446E7B88D39682945897721B5853E32E4EED4392D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Lunar Client - Installer.exe
- Size 3.1MB
- SHA256 b4486ea5d9d2dc954ee5545f082dbcefdf71068e465f91d392b497849f3e1698
- MD5 8b8cba76f898b8586f73f6ea4ed1d9d5
- SHA1 41ddca8d5f95978c023c3b1bc6f3f2652b643de2
- SHA512 9d76b07b6cc0f9295b230d21507a6d06425df2218f45fee1f3fcc98add2cf1ccf8de58fc445c9e5efb30125efed9e6bf737ff97cae606cdb535eca8ced7ff3dd
- SSDEEP 49152:5mAvS9J6xE87vxpsrFpIvQ4kvoHch90kfsFYEXupw3UhsooAFhR8MShqLAEqcY:5heJ8PN+TIvrWccYkHouCkhsbc8M3k
- TLSH
  T112E523E4B820DC3DE6310EF976F8C446E7B88D39682945897721B5853E32E4EED4392D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/app/js/utils/cookies.js
- Size 1KB
- SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
- MD5 6c60e675f8c8c68c0174b644d3a63a2a
- SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
- SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
- TLSH
  T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $PLUGINSDIR/app/js/utils/modal-events-delegate.js
- Size 1KB
- SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
- MD5 117e4fdbdb0ecf211c8bd909efd337d1
- SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
- SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
- TLSH
  T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app/js/utils/strings-loader.js
- Size 5KB
- SHA256 9b833f9e058ddb31ada44764449fe030f05e241dcefdef46886a74e30cd04ba5
- MD5 8ac781fa72423fc5c4c21a8c4138b709
- SHA1 50ad1d7f383d6801c57f916e46c1c17f79222725
- SHA512 f78558488968b1151b189545294a0bb97131c0a4d5dc0fa61ef168d999151e0f12af271389aae985d129adacfc6bf610b0191fb912ffdf8e97283829e2802604
- SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6Wfwk0lx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6WGe0muXDK0W
- TLSH
  T132B1ED58289354118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app/js/utils/utils.js
- Size 118B
- SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
- MD5 a0952ebeab701c05c75710c33d725e7e
- SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
- SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
- TLSH
  T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app/js/windows/cri/cri-controller.js
- Size 5KB
- SHA256 8c8c3097f0b587d715e051f55894d73a0fb7b441024f47512fa340eb3f692152
- MD5 344b079e423000460dbcc623d3dea42f
- SHA1 6f7a6db5cdf0e4c511ae1ec8aa1f08dd9e79190c
- SHA512 15358d30f96ba6ec330417896ccd5c837e71b1712357185d7d84e60e8e6c21af52eadc1fcf61f6ce9a79165fab94813370a5ef0b632742043355ae3eb7eb6856
- SSDEEP 96:u6CeVFfOhETv5T6ToY/aq4bCWCtoQNxcGyUkeErscwn:u6jVtOyl2EY/aLmWCyQNxaUkrscwn
- TLSH
  T1BAC1DC9C7CF9866058B7277BCF160518E732420722426A2B7AFE83404FF5E404A16FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $PLUGINSDIR/app/js/windows/cri/template.js
- Size 1KB
- SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
- MD5 2f82acef2d339db31fab5c73edf8af19
- SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
- SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
- TLSH
  T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $PLUGINSDIR/app/js/windows/cris/cris-controller.js
- Size 9KB
- SHA256 13f1bb9718444c1e15dc13cd99862c8ad4cd9f1a607680906309f1ed9a058231
- MD5 056d641203097bf638dc846e01712869
- SHA1 64f77761e9eab875f8dfa67f3dc5d488aeb9d4f3
- SHA512 88e1e2e7d26fee9a37ae9b0c9fea3e61066a9c71f15b8a6e328bec6880f6b9795ec8e85af6055350d2a10d5bb814cdb6cd5c0fc09f29553dfa4b2c6d8f64a3c8
- SSDEEP 192:nCoyl2vxrZn2C7s+vK/H0mIvo99hnap0kelwPcGMJ7i9W:9yl2JV2C8/HyqkelGh2Z
- TLSH
  T116120E1998BE26299A777375CF6A0508FB3042172944EA1A7CEDD3940FB950182B7FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $PLUGINSDIR/app/js/windows/cris/template.js
- Size 480B
- SHA256 c6c0799e027b5554e44e1c31262ef62b2879bdf1b862fae56615426f07f471d9
- MD5 408961db547931d2427d96035dc7245c
- SHA1 8a0330bf52f53cb1e82e36cd67723ebb29d7a6bf
- SHA512 08d79c8f54cc9898956df5b4de8360a38d482ad19ce155e84a33843221a0242240c59c49ce0ef980e150fddce716557bee7071a6525ef438fdcde9bdacee95aa
- TLSH
  T1B5F02E114135CE20373F17BE93631B28F631D0024A82E634D5DB5790333B4E78A96769
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/app/js/windows/finish-with-recommended-app/finish-with-recommended-app-controller.js
- Size 6KB
- SHA256 ec775a786d8f0170c33e7d28df1f724aa1de26ff0aafbbf41c26dab864fda48e
- MD5 8f0cff982886d07a530a1ceedba4bf2c
- SHA1 6348b32708fb6f70225a3fdecdd616475a4bf8a3
- SHA512 cc688485cfa0d3787496f8a65e222a38a5b46c0b3b41812b9e1246f0195bc6dfcdae1cd2c82a6f80620db91cd826a17fea5f31879c6ec7e3efb580ec71a4aca1
- SSDEEP 192:otBaiFc1rnGDtjUnuYu7t7jt/Pv0+bnZ7uc:otBaiLZ++tHt/5nZ7t
- TLSH
  T1BBE1004C9E9E5168E53B733ACFAB4188F73502271540A617BCDDA7986FF0245026AFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/app/js/windows/finish-with-recommended-app/template.js
- Size 1KB
- SHA256 f2f955faf5dc90e9ad50815566aa42a693128f97f07d02c5c3a1dbac27f570c4
- MD5 e3f895c48a2c99c3e8656c9093075286
- SHA1 4d1c13a0f03ba903787b23f5f27563966cc08a31
- SHA512 7c71787b7bc49e77923e178fbc38e2fe7e45283f257766020a21e25535ff095b7896406e612e254c46fef5af4a0fd2a4a9f5ecb0b33fab91261f01a3bad9a54a
- TLSH
  T1D1315859425F9A73173A468E9B670EAD3960DF02C8B00F11B5DF4784E3735888EA7318
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $PLUGINSDIR/app/js/windows/finish/finish-controller.js
- Size 2KB
- SHA256 c57d168e804e06f26709322e340076e576d405a72cee0b663176c6167785c3b3
- MD5 b4e14fe186c7843fe1365b630a4a17b3
- SHA1 86619b54889f3da9057a4937584df4acebf492fd
- SHA512 bd0e5a72f6a6145c6177248351bb2ab2bbe7ff66d36dc7d022ab81d614eb39f2a0a3f4c267c3018202d17e175cfac5755138b6a05bd7f3c7b358dddb20635640
- TLSH
  T1C841AB4879FA43B66B753B3EDE290655F732422B0A0A867A3DDC92808FB1014039DFE4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $PLUGINSDIR/app/js/windows/finish/template.js
- Size 1KB
- SHA256 cedc900131ac48e92bd931926946dc342a99de1b16757969b7416f8ba037fad7
- MD5 6410e00eec2197f48a0d2ff66d0c07d2
- SHA1 480c640d3849cc90fc881306322ea96e31c1207b
- SHA512 302f2fa32afdc0d2e8729a91ce20d16427f2a6d56f97a84aa1785c3babaaeb080ff8d1ba400a0d1c3917646b1597e1800a36622f3ebdcf14979da6e3a76879f4
- TLSH
  T13221289D426B5B37073A469C52675E6D3C60DE00C9710E29B4D74780E37789D8EA630D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/app/js/windows/main/main-controller.js
- Size 16KB
- SHA256 2cc465c2bb45f3fcee61baf732b4c87cb50b4baa64864bf832475f45e2846113
- MD5 3d497dfdfa6f36a812b4988a79bfa641
- SHA1 d5c951daf21080e9ba18b05619252d5b3624d20e
- SHA512 f500817f58c407c0fac8290d77b0a7e9c6d8198bd6bb126eaead92a892f0a1efa9a09ea953349c21d62a3067cb1bff00257bcee67c6bab49b782e9688b1241a8
- SSDEEP 384:2Rp8ChTvzkzPZPb5yPQZ688wqUaftN23n:2RprTvzkzPJ5eQZ688wqJftK
- TLSH
  T171721C0879A8167895B7333FDF6B0649FB71102B45068A2A3DDDC2C40FB1811466AFFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/app/js/windows/main/template.js
- Size 3KB
- SHA256 d827fab7a8ec31dd68bcd7e6725c01b7d72d1224fc0c1a136dac513cc7884d0d
- MD5 694ea1756f2dace45053080494afbb70
- SHA1 f503248779de58075f5a3ea9ba97a4838b95d1a7
- SHA512 aae8397bbea463cbcff7a26efbc8be6e9697a65073fb566fbe0d32a68dd4e656f9ca70268a1faacd2b137cd7fdeee1a380f4b4126cb1ee2a6d2bcf07bf076029
- TLSH
  T1956131221065157267BA42DA56266E7AFE61E303C58B9F25B6EE13C007F3C42CDB760B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $PLUGINSDIR/app/js/windows/modal/modal-controller.js
- Size 3KB
- SHA256 327e18d2ebcdad776f7def86be1f8a6a2c3f68611630f71f0d51c1437ca9586b
- MD5 21c95dbadab8f6ff6e8f457f076c33a3
- SHA1 848fde4d32380ed71d4209ce9d5fce1896b6cd3d
- SHA512 6c14b7c6cd58a549fef9e5a4ec9a2a88e2eafdd774d63532c932a308664625ae9408d42b97d9e1adce2a5ff8293d91d94187090647cd2b40b13aa0e8c4861b9b
- TLSH
  T15451478A242A116645BB737FCF8B029AFB73509B4A45461A3FCD87011FB081093DFEE9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Network Share Discovery

Checks computer location settings

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32