General
- Target LDPlayer14_ens_31742314_ld.exe
- Size 3.2MB
- Sample260908-sxpycsdq7v
- SHA256 55b61915f530bd597b380abed9b7bb59947291e8af4a507516136f42c5f89a1f
Malware Config
Targets
-
- Target LDPlayer14_ens_31742314_ld.exe
- Size 3.2MB
- SHA256 55b61915f530bd597b380abed9b7bb59947291e8af4a507516136f42c5f89a1f
Score10/10-
Family: Guerrilla
Guerrilla is an Android malware used by the Lemon Group threat actor.
-
Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
-
Family: Mandrake
Mandrake is an Android spyware first seen in 2020.
-
Guerrilla payload
-
LunaStealer is a stealer written in Python and packaged with Pyinstaller
-
Mandrake payload
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Possible privilege escalation attempt
-
Creates new service(s)
-
Modifies file permissions
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1