lunam | a8b7cdde6f0f217ffafa43277fabf9e4970cd1c4ba03164fa78cbb9a58a59c6b

General

Target
a8b7cdde6f0f217ffafa43277fabf9e4970cd1c4ba03164fa78cbb9a58a59c6b
Size 6.5MB
Sample260901-hzx2msbf25
SHA256 a8b7cdde6f0f217ffafa43277fabf9e4970cd1c4ba03164fa78cbb9a58a59c6b
MD5 b927ce1e8063d7b9e1597ba5e35d07d9
SHA1 d21db63c80cba3997ac3cfcd7849e058219b8ae5
SHA512 8e9db4c1e714c91e838f296f1bfaa5c6c0a24a129bda8fd1dc8fa7ecf2ac89c72092dd8522afef0e4d2c9da9d862845d168792c6f4c2e074c7a39ca684864b76
SSDEEP 98304:bPU+35/aBMQZqDcFP6dIPU+3mhLCpj2xr85XH085++PF7+PikUQ/kU3:bJ8zKA6+JWlCpjfv5tFuiU/D
TLSH
T1CE66D14CB3A6087CD62583B51571112A6374BF220B46018B70DCBB3A7FF7A59AB33766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan lunam

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 1 IoCs

resource	yara_rule
sample	family_lunam

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8b7cdde6f0f217ffafa43277fabf9e4970cd1c4ba03164fa78cbb9a58a59c6b

File Explorer

a8b7cdde6f0f217ffafa43277fabf9e4970cd1c4ba03164fa78cbb9a58a59c6b

.exe 6.5MB

a8b7cdde6f0f217ffafa43277fabf9e4970cd1c4ba03164fa78cbb9a58a59c6b

IMPHASH 1a8b8115340672b2c6efc9d61d851a23
SHA256 a8b7cdde6f0f217ffafa43277fabf9e4970cd1c4ba03164fa78cbb9a58a59c6b
MD5 b927ce1e8063d7b9e1597ba5e35d07d9
SHA1 d21db63c80cba3997ac3cfcd7849e058219b8ae5
SHA512 8e9db4c1e714c91e838f296f1bfaa5c6c0a24a129bda8fd1dc8fa7ecf2ac89c72092dd8522afef0e4d2c9da9d862845d168792c6f4c2e074c7a39ca684864b76
SSDEEP 98304:bPU+35/aBMQZqDcFP6dIPU+3mhLCpj2xr85XH085++PF7+PikUQ/kU3:bJ8zKA6+JWlCpjfv5tFuiU/D
TLSH
T1CE66D14CB3A6087CD62583B51571112A6374BF220B46018B70DCBB3A7FF7A59AB33766
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Lunam
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5620

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames _CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaFreeVarList __vbaEnd _adj_fdiv_m64 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList _adj_fprem1 ord518 __vbaRecAnsiToUni __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaAryDestruct __vbaExitProc __vbaStrLike __vbaOnError __vbaObjSet _adj_fdiv_m16i _adj_fdivr_m16i ord598 ord520 __vbaStrFixstr _CIsin ord709 ord632 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaVarTstEq __vbaPutOwner3 __vbaPutOwner4 DllFunctionCall _adj_fpatan Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler ord711 __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 ord607 ord608 __vbaFPException __vbaInStrVar ord319 __vbaStrVarVal __vbaUbound __vbaGetOwner4 __vbaVarCat _CIlog __vbaErrorOverflow __vbaFileOpen ord570 __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarAdd ord320 __vbaStrToAnsi __vbaVarDup ord321 ord616 ord617 _CIatan __vbaAryCopy __vbaStrMove ord619 _allmul _CItan _CIexp ord580 __vbaFreeObj __vbaFreeStr

Sharing