9395ca35b93062b1dbf32eb94adc4fa8ccd1bbad8f63aad36f9f2073e39d2d10

Sharing

Copy URL Twitter E-mail

General

Target
LuxorCollection_Setup.exe
Size 45.8MB
Sample260925-w32qwstdjb
SHA256 9395ca35b93062b1dbf32eb94adc4fa8ccd1bbad8f63aad36f9f2073e39d2d10
MD5 9dd4c9a955872c6b80eeeeb5930e656b
SHA1 2e6ee847bfaaa7d2162882878e2b47e0095c3c57
SHA512 92554363540d79f42ae5f32e6d712534dc772c9f9c13676597a27cdc1a9471d0ac5f3ac3f94af8ff5cb4f285a6bfde4de0286edaa5353fa21733ea409184a990
SSDEEP 786432:O5l6pBJFhEbCYFvH6XneM6Lj3HqHVgbuNX9Q4/W72EoA+5JxWoCdNXUkaJenLuvs:gUhEbHM8+HVgbB4p5CdNXUkdfx
TLSH
T195B733533E34414FE9577838160ED2B2AF32BD68862B1E7A5960BA63F0D17E0D46D7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  LuxorCollection_Setup.exe
- Size 45.8MB
- SHA256 9395ca35b93062b1dbf32eb94adc4fa8ccd1bbad8f63aad36f9f2073e39d2d10
- MD5 9dd4c9a955872c6b80eeeeb5930e656b
- SHA1 2e6ee847bfaaa7d2162882878e2b47e0095c3c57
- SHA512 92554363540d79f42ae5f32e6d712534dc772c9f9c13676597a27cdc1a9471d0ac5f3ac3f94af8ff5cb4f285a6bfde4de0286edaa5353fa21733ea409184a990
- SSDEEP 786432:O5l6pBJFhEbCYFvH6XneM6Lj3HqHVgbuNX9Q4/W72EoA+5JxWoCdNXUkaJenLuvs:gUhEbHM8+HVgbB4p5CdNXUkdfx
- TLSH
  T195B733533E34414FE9577838160ED2B2AF32BD68862B1E7A5960BA63F0D17E0D46D7C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 17e2f205af12d5a86638dc83c95fc69199c41af2fa6daeb1e91ec330f68c5372
- MD5 f62d03fcb1473110e920a9bb2c701006
- SHA1 c48444ef2daa60dcdf91f1645cd4ecd8e66545f7
- SHA512 701d531d405d08054d53298141d5bbd56e74df7b22bcea5f9f0e5c4407421ea0ca9617aa84e740dc1dc44e6d14e58852c1ca2087213cc2319f2da44eaed0bc05
- SSDEEP 192:g6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTxK72dwF7dBdcQOz:g6JaVh4I5rpPbTx+BdhO
- TLSH
  T1F1523951378888F3E792053EB45237079F9D5226B8929ED1CA331FC62D2B19E2FB1302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 e67277ecc4f6c7beb3c7e586ce508677269db056c7541eacfecf6c719f559da6
- MD5 0bbcbaee7b703ebd55cd8658a0e8dcd3
- SHA1 6ed448b8b67cea36eb45bfbc67fed9a6da9623e4
- SHA512 604c524bd00313f6411cc9878d5c9a1db77588049feeb5bb02c971df44f8becbd18d251cc20e551b878173eb2a78be61f31352769597c6334cffc0bc2326b008
- SSDEEP 192:WO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1azgMO:TKAFERdlxhGRYUzqZaz
- TLSH
  T16B226D5547A041F3DD60823C08973D276BA837148EA54EC3CF9314429E296A6BCBC336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Luxor AR.exe
- Size 204KB
- SHA256 33eece90c2012ef71ff84e61670b742fc07eaa0cb2a1edfeb0abda6024c93c1f
- MD5 c668cb3ae12e7b1ec4cbbf016d6f7c7f
- SHA1 fd01f6f46cc128f0f435d8210151819c119f8cce
- SHA512 f44d413e401859fdf9fc0307ffcf666b7aaccb7ed711bddb1a104ef32cfbed23708a1d553819a5f5be586aef67370272afbffbdb01231fc81afe01c826e19e3f
- SSDEEP 3072:zaeUNiIRXRc1jNTvmsQVKb+V2cqBYZ+oFAcF/rWp7De59TY01qX2Mz9:Oe1smcq1/cFOvelqX2M
- TLSH
  T1AB147C3064F901F1D64B227414ADEBB1BE78EF391B294687B764FE473D33260A426276
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Luxor.exe
- Size 192KB
- SHA256 75ddbf5f23aecb475c1adff13fb90326699f399e895d0ed30fc1c63f6bae001e
- MD5 5ef0660847b31fe959ad1e1487913a4e
- SHA1 7201ba4fbcb1e86c20c71799845335788cd66991
- SHA512 6fbb8d7bcc9c3632b39e3cc1d3b736b5bd71b4f48e35d31a78e3cd2cef66423f6945f0d4769317c1e9e31506c46032a242d6b4bd77d30bd52f714660f8002247
- SSDEEP 3072:EW/cdQqHbvRflsxscJnxx2X0A29v68RhzZuEwQIWBq7lpQrfj5zwxh4sh4knFuuW:t/ciqHbvRxqZ77qRDIJlU4
- TLSH
  T153147C3134DA00F1D2822170219AE732E670EE7517790B8B7365FE3BBCB65A4A527277
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5
- Target
  Read_Me.htm
- Size 48KB
- SHA256 2270f3a30d5581796f57d3ab471cff906bcdd1b1d486893078f27f47658874f6
- MD5 88a0de08687270a020130c34d2f2458e
- SHA1 c4ebf7e9be900402ca7b02ba8fd87573ae47a0a9
- SHA512 79fc8acbac0c7f29d9ee812ad4756fc1297694d19fb6fdd11e839b491c35aae80828081a3d624edf3fffcd4e64c68a1a97b6698dabd465f12aecc1d0a430367a
- SSDEEP 1536:tPCWC6mBdeKg93UhEnTY3ZscEm/SBtu0ev:lqX
- TLSH
  T110233100E7512403907B85CDF06B178E248096649393EE65F13B697FBDCAAAD36872FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  core.dll
- Size 56KB
- SHA256 86360b86275d25b2668e640a7d46611d4397ed0348d57bbb4637a1a7a805207e
- MD5 7ecd611d0af701520ed1ce10047a8553
- SHA1 d7673f5ce5917c8220c78f0024be58566f65522f
- SHA512 e42744530abede52427e1cb012e05aea667bebe35094c3df54cc79e3db2d1ace90e4cbd1ea03d9622af18c3f8e3719413d5e0b1470ce1221d70962e9389a058e
- SSDEEP 768:9aFF+Oq9pXiK/maHeyJVgDPSkqEA5hSo0Da/4q:9a2Oq9RiKOa+yJVaLqEA5eDa/p
- TLSH
  T1AB435B0299B425F7C280C0363BDCA73BFD76D48585A28D5B0F37CD687E65227B42B662
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  crash.dll
- Size 88KB
- SHA256 64ef7a1414d02ac6e65a6588097b9b5ad87f12072c9fdfda20f6b49eae4bf307
- MD5 db527de6ae97908ba772f4e1abbeab31
- SHA1 4c8ea2bd0c13f0714b0c4b2ab9138166a2f3d13f
- SHA512 4f0e47397ebed8179718010f82e8fd3cb2df41c526fb12f66980cc83f1ee07a1290cbc9c836656414ee66974993c596d63bedbb5b8924763ba7ca13e0a75a22f
- SSDEEP 1536:iMoVm4jFmop00m7WR6VTTQcSEB1I5BoLbwGjrbXsw4DAv:iMoVdmoQ7WwFQjFUVrjsbDAv
- TLSH
  T1F4938D2167F340F2D196157624B58F3BAB7D6E10CEF28D8B8B93D8591E30992D636307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral8
- Target
  dsetup.dll
- Size 34KB
- SHA256 0fdfff9a5db0bd4b16a9663a6616308c511a21e3bec0bbed60ddfa2597c73acf
- MD5 4f5f399a970a921f883975a2228a1c8c
- SHA1 f2c39bde79a6d91f8e35dd4eee5ebed4573c5615
- SHA512 7a03587c77eaad433fb49694b9cabbc0bda8e8554a97ee3ec63ca09dd7df37cae0031c1b9b52ab4d76d45fd847adf5a7680bb0dc803166ce4fb4cfc12aa017ef
- SSDEEP 768:7M0v0mWosSeNwRQy1E5MYDgZBC7Q3+jPJmEDUWe:7PdRzeNwp25MY8nC83+LJmEDTe
- TLSH
  T192F25C1279A180B3D151463529E9A702A3BF802456FE8D87CF1857999E733D7BB3E307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  file.dll
- Size 28KB
- SHA256 c59cccf662344e978f3ddcd8c080b807f79a84c001aefd49ddb80f7aaec8832f
- MD5 671cc1e11d5721fc5c07284c17ee5903
- SHA1 6b8a521ed2109a559f0cc70fa460e88c8351d943
- SHA512 3eb987e0873536ac47a86a5364e31c64937651f957b221e02b7cd5197a9095b1bd6ce734be861fbdcaf91c57cc0eeab221aba915d55b369831930801a5c77242
- SSDEEP 384:JyxFATdh8tkiy8o4BsiZuZfhHNMS7Czk31MDob3:YxShYyvSUhyQCzw1Mc
- TLSH
  T121D229173A3210F2D18A167132DA733BAA35DFA5564517A3D3E3ED30953B623F026B64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  fmod.dll
- Size 157KB
- SHA256 7c6f7495d0a981f646bc23fdb39c0e349c598f5d6f4ef0ee58311338ae760194
- MD5 f51a7dd4d040a9c079cf64d36f569673
- SHA1 430cff3cd81c0cec45207caa98ecf1ccc2b4971c
- SHA512 79ff5a3522559e6dc0f971cbceb07be0a39a5d538590cb9a9f3d52970c0cda1a12da1d8055de923097a7485b1dcfa54dc56709520073c9395607624c0a1a6df2
- SSDEEP 3072:66COMOtCkffbueK5QlfQxHTaR2mfm+G95QLOZRnFMFsE9JTjaZsKEb:jcB0bBfWHTaR2mfm+G95nZxFMyy52Zs9
- TLSH
  T10CF301B571ED603EDBFB04F617C9DF718859B53707F22A94114AA28A089C10F6E82F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11
- Target
  gfx2d.dll
- Size 108KB
- SHA256 d571db41d3c174a67ad91b69f0c5bbfb876104d90c54853bc47a1b905a08131e
- MD5 d36484cb65719dd28956e22cfeceffd0
- SHA1 33e0415d36c3b291996e3cf7665a726b40e98672
- SHA512 282558b585d28609aca9a592c4495c4d8e19a788a3a65818561304941eea569a287de0df9084fa1ac3b38490bfcc157cc5bc18d75c525f1c99c630ec97eab111
- SSDEEP 3072:ud/LpNYDAhhhCvTBQPf8OFKnxkQhw2oqWpr9ZQ/o72OJW6sHq/FG:OTcTj5ydT3c
- TLSH
  T19CB37D0A795B21A4E21152BCDD547A7BF83FA9F179886F875B38D9304036520BB3323B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  gfx2d_dd7.dll
- Size 60KB
- SHA256 0bd1e468018b8261f38e114f5976ec84033a755adc55463f1c108edae8601a56
- MD5 ea990e17b826722eabe0a0632ab9d026
- SHA1 95a518a80dab6e5eaa1f84f930e0e62e39cab63b
- SHA512 2f93ac4dc7ee0aeaf05e67f743ffc64e001d6b294a33420118154d56865b764092c8a3a424d4b4611937a6406c2d5f6dfad23ab22b6102713022c83af5fa4379
- SSDEEP 768:8hH0pyctUuB+/x92iaG/gSOJ6yEA/SmodU7qZ6mheGz7v4AZCTLNYzO:81o+kdJ6oGv0TqK
- TLSH
  T146533A10678225E6D247BB70743E177B8F77487800EC87CDAB2AEBE97466134933E642
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  gfx2d_dx8.dll
- Size 36KB
- SHA256 21f8e46a5e21c38f75dba7051b4886df8df79985265057a93211290b166f9c43
- MD5 49469eb567d3ee916f13bb9921253cdb
- SHA1 170b87f907adbe47f9f4a2cda6238701da2a32f7
- SHA512 c469b36b2d4f8b0a8329ff9c39a3c0f5fbaab803c2e4595814a5af5a31a1138d6f0bac54966d10ba03eb2528da9af8e953b8676d1c0757a213543efba18d4ac5
- SSDEEP 384:m8eXo95Xx4Ec2AqQ0a+UpMlhnduw4IEErj5mGreYuRf:rXxBc2A30avOhW+5mGri
- TLSH
  T113F24B02664376F1E71325703859BF37EFAC06E52254EF69D727DAE15867022B23BA03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  gfx2d_ogl.dll
- Size 28KB
- SHA256 c014f6a2b67d05a8de3d1beb53c12880fd8d7ab738837613f788cff3ee339709
- MD5 b6c2c6668df8fc75f84dd8c2221396c7
- SHA1 cda97813a240a58aca8f9d5028f2519517bdc500
- SHA512 0142a1f9fd48114ee39768520e3ed9532872c81051f4a25bff38828f6ae5aee477b6bb6bbdf3cbf891fe9281d7df38ca54e7e360202bfe1aed5b0aa25cb8b515
- SSDEEP 384:fGKyR4lSXE9+eNP1p5/gEhprtoCYS4Tssggn8qOJeiu4a58HLHfEBW4TN5r5GVLC:xyR49+ar5/gEXrtH5g8qOo8HLHftVWh
- TLSH
  T1A3D26D43CE1639F6D104603078A977336F217DA612E681179BA3DD76EC3A233B329396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  imglib.dll
- Size 28KB
- SHA256 9a46b1b447ddd241651f4df924eaa1ff83338702915859984cf716d2abe4afb6
- MD5 7d02c9bf2ba850341448ed094d3793a5
- SHA1 f0de9225cce96ba7f9ca0c274dd37262bacdc1a2
- SHA512 76aa550abdcea3757428c5bfb23e791ad14330c335a921f578b0f575ce340b56e5b0a9f467f2a22451cc5dc5eeb45f6d399482448277387d48b023bb0849f20b
- SSDEEP 384:5xWWKvNXRT+uLtSRNzHA3JfH76ywAZI5eK5XxH:5zKvHT+KtS/H4JfH7sreK5X
- TLSH
  T15AD23B96F3EB95E2C7074D313996A233A134EA68516C87537FD9D6A39C33632383A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  jpeg.dll
- Size 96KB
- SHA256 ded028a137b762436c4693a8a59632296cd37e2eca5500aefea585416ff969c0
- MD5 a5269bd4a772b7fbf9230491304d3033
- SHA1 dbb8acb189ba4d50c64581ca2aab67a32759a3c6
- SHA512 497b3065a1a406481b4c26643f71d24bf5a3292056f81f9cc5caae34e04bc0c3bd1faa13da8d00b3e728ea18770e1d65c0716d212c07ef87cbec391c1b2dd2cf
- SSDEEP 1536:1jxV8tZCff8E3+SEEuTxcMolDxVWdeyaHvmmPtivzxJbZIqqnV4:10tZC3LhEEUxcVeeZHvXdV4
- TLSH
  T176A37BC1BA8640F0D9852B70609BB7779F39174B148FDB93CB34EDA15923632FD252A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  logger.dll
- Size 48KB
- SHA256 927efee976abc7b9c37b77f1de3510443b9c1c3ebd019285d3f8a5cdaa49222e
- MD5 da359b9d335e92861eeee620ad613476
- SHA1 b36d9ed3902d237278784cc0204d54f2dfef6c03
- SHA512 9d5a84179201766491daf74d8f9db7ee7b875937f438575e1d61b2d842f1290cccd2f8f9f19633fe4639ba34495d73357bea23291da3887d09d78341782139db
- SSDEEP 384:BK8RfRO7MZEx/FpxpO6K1qBKkAUc07xgUy+VEy2CMzUL69:fO78StMO9hMzf9
- TLSH
  T136234E022620B8A6D195253710FFAA7A731AAD004F4D5FC7F276B96A9D392C35D37703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  net.dll
- Size 76KB
- SHA256 ddb66c16612adb75997728de8150871a83cf270757c620f39df3e4b17e56e856
- MD5 83c4a86decc9b14e4dbdbaad3fe5f7cb
- SHA1 6dbb2307019b93b8199011a76ae269e92d9bd335
- SHA512 07f5b75a1f3ccc3f5393c5fa06edf8e35bfd18c140208e19d82e2c8bef8e7ae5f93f71dd631001a20bf02be3b3dfe10632fc586a79c864a97b569b849e085347
- SSDEEP 768:PQV5ootkFko9P1hX15gTbgxMWzL8lhNS0c12iKwseCrCyUBhjEiAMoXECsRuJcvZ:PQnoMkZ315gTIEhT0+rCyGbgs8OiVk
- TLSH
  T1E373AF5075E681B2C1CC513728462B37AFBDAD200EE744B3CF69CE697E71991A63B107
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  snd3d.dll
- Size 48KB
- SHA256 e90bc2baa38235ec0f5174d2dd5dd05445578e4ffcb9e5c5e5669e4d5ac3bd56
- MD5 3208ab46a1cc2ff6c16deae0791f3c62
- SHA1 5a568e0d0debf6c45304124c8a08b79059978c37
- SHA512 db6c2f9141cf746953c962b9212d1f4cc0e212b2d5965944038f980a5e0cc1bb6877b0ab0d9a0c7887689cf0b7aae42fec9561e01b13c95560fe07a6e0e218ae
- SSDEEP 768:ZFy/l2vMkgP3DRHD38IakFEJDPe/F1YDkq:ZellkM3DRjMIakFEJDPe/F1YDk
- TLSH
  T1F3232A26116310FCD381E37999BD323B7AB5C98919C273C34F37EA723975171AE1622A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  snd3d_fmod.dll
- Size 32KB
- SHA256 1ec55f349ec7b8dfca364ddf689f158d7d1e55e540d91d8bb2029b1a3eb6bbef
- MD5 18068f2278294c8b578485a7b22e4aa2
- SHA1 9593d10364c52ea6ee6f9a38a1d8bbbfa34df6fd
- SHA512 785e93a72baa01a584eae21f9b4dadcda1782b3463753e0d617129315f81bf4ccb47c3476294addefffdc567f3f44dcb970381fa8b097fffcee5827e84fdb491
- SSDEEP 384:0nAcE6dhZMjAxAii+2JiyLPVJDndck/nPzMLyZE:0Ad6Z6AxAi2PPVRdjP
- TLSH
  T10BE23B25387700F4CB78843024ABBA37DE35EC6607F4B5D387A5D99A6D1C293B962E43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral21
- Target
  ui2.dll
- Size 180KB
- SHA256 7bc2f53c7f2cb0fead9ed0ab013c74fbfed930b6394968dc4bc758d24b695803
- MD5 3c39d7793a3deb4c6c5f5d18b4c20105
- SHA1 2a5859c45eff649c5142714f3ab6dd8258c815c2
- SHA512 5b608c435aa95301af771998f34f0f74fd89eb51679b8b6005ddbc81536cf65453227e3c07f3b2234b16e357f12ee9342db9f652cf0cf597e11a33144cca94e6
- SSDEEP 3072:Tu9dW1fERscEXAX7X1YDmVUeBX2FT1Csh8+kz1Elmh:FERfmALX1Y8UyGdx8+kz1El
- TLSH
  T121047C423DAD02BEC34D997C2C562BB7EA3FE6A493E25F835F7CDD8119251B40926312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

UPX packed file

UPX packed file

Drops file in System32 directory

UPX packed file

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22