73ae33060cc15e5a0d6ed4bdb22846d9c7d73c2439ffe56597bb8b4c695da6f0

Sharing

Copy URL Twitter E-mail

General

Target
Lunar Client - Installer.exe
Size 3.1MB
Sample260925-yft4msysdv
SHA256 73ae33060cc15e5a0d6ed4bdb22846d9c7d73c2439ffe56597bb8b4c695da6f0
MD5 fe2faa9b988b83943399d1d82fa10d1c
SHA1 315e402c200206c9f84f8322c7a053cce11b26da
SHA512 24c738477b7f367ab02acf7cbbb68fe41701f7a843723494534e6c13c183cc94f344fd5dca80886a9297c0a722eb6e2d32b3197e6e5d67823204434c9942db27
SSDEEP 49152:gmA3ABS2xE87vxpsrFpIvQV0aiF4hkCsihYEXOpw3UhsooAFhR8MlhqLAEqct:ghOSoPN+TIv6a4hFRuoOCkhsbc8Mmk
TLSH
T199E523E8B820DC3DEA310FF9B6E4C546E7788D39681855897721B5853E32D8EED0392D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Lunar Client - Installer.exe
- Size 3.1MB
- SHA256 73ae33060cc15e5a0d6ed4bdb22846d9c7d73c2439ffe56597bb8b4c695da6f0
- MD5 fe2faa9b988b83943399d1d82fa10d1c
- SHA1 315e402c200206c9f84f8322c7a053cce11b26da
- SHA512 24c738477b7f367ab02acf7cbbb68fe41701f7a843723494534e6c13c183cc94f344fd5dca80886a9297c0a722eb6e2d32b3197e6e5d67823204434c9942db27
- SSDEEP 49152:gmA3ABS2xE87vxpsrFpIvQV0aiF4hkCsihYEXOpw3UhsooAFhR8MlhqLAEqct:ghOSoPN+TIv6a4hFRuoOCkhsbc8Mmk
- TLSH
  T199E523E8B820DC3DEA310FF9B6E4C546E7788D39681855897721B5853E32D8EED0392D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/app/cmp.html
- Size 5KB
- SHA256 5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c
- MD5 17241946e51074e6877c43737b94ad71
- SHA1 16918c53471fe3f35fcae1e9902870d91c50d957
- SHA512 b4b6e030fd1abe19fa308b32f04571a7c1c1f78a7cb789f169b37b54f281ec66d16e4cf0bbbdad81642bf28e266a6b2af7c19cf5106c683fb7f443bfa3110e05
- SSDEEP 48:tZrc0/GdshWpo1rckthAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4Li1:4V+8v4jHa2NGiivmmpWsBVuQFwlE5vSG
- TLSH
  T15DB1DB1A2D5914A80077E3385B6B6208F72AA1B72105CA067EACDE513FB152BD58FFCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/app/index.html
- Size 27KB
- SHA256 29b31e024477170e1f76ab145eb7a9bcd919389f5438db8a171bc9f55154878b
- MD5 5ad4f3206b65b951bc79e710f4eeb3f8
- SHA1 2a5b2ffb50e02adca04949199a10ec101eafe866
- SHA512 ad6c0b47c7b407305859ccb45bff14d734ab4aedf08bbde9361cb1a32cb9b8a617b2c90723d669fc7c8f8a297e7c861d9d2abc4cbaad16807bd7d761d34cad24
- SSDEEP 384:vN7Y6FCs5XRJ/seq06IfLglbyMaAt1vnEF+ggevsu5SwU:z5XX/seq06IfLglbyMai5nw0u0wU
- TLSH
  T132C2A611DA36202DB137462A75E2BA5D3034C117E5639A7EFA5C9674CBCB18B1F23B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app/js/app.js
- Size 24KB
- SHA256 3044a9dfc31d8bf16f1f1018c6751adfabf86a4e93a398135cf058ca72a00fde
- MD5 5609e25a421159b37c62f9f7b1ac81ac
- SHA1 19bcf1093d0f128aec0b7aff648c32913a20fa4b
- SHA512 15012c0d5ae05f543731cd293af1f75a1adf0b0d8b0a10428343135dbfc592a303451f83c3ddf2e07d26fc250c4b641f6cff9b3ee381e1b91eeb7219fc4c09e1
- SSDEEP 768:0+ycDQYITdIb+sH3A4nzaYHhGifG3yRrH+K8T:0+yUQYcYbe1K8T
- TLSH
  T102B2968E967912789573633EAF1F4618FB32122F110596273AFD85814F7141282A7FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app/js/block_inputs.js
- Size 789B
- SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
- MD5 b5b52c92b90f4283a761cb8a40860c75
- SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
- SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
- TLSH
  T14301D2D864D3A87A597DA328536BE748F7391964905A1054F0DC8C64BAF003BC16EDFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app/js/libs/cmp.bundle.js
- Size 392KB
- SHA256 7e14f6927d403bccba24e1ffc6a5a2f539cf523f45dac0a12be9665767488c13
- MD5 995d2abd2b152d1b2225f802f037efb4
- SHA1 f9e14a8a20066e041cb4d001e40dfee55997245f
- SHA512 7f075a65b7a93297fca266f07a8dcc360f1f8ab52a5888fe8199051346ecc76da1a396bb01235974d1e9e619c481254b1ae2ef8038eb913b01e5bd0638e53511
- SSDEEP 3072:6yMQM9zclmGxPMqbOISP88GEAlHYnnhriIFkNOLh6FhFldSxRAcDqE4E:jblmGxPQGELrjkNOLh6FLlA
- TLSH
  T116842A8D7991B0E617D762F1802F900BF33A6458784CC490B660D8F0ADF96AD927BF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
- Size 90KB
- SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
- MD5 44e3f0db3e4ab6fedc5758c05cf27591
- SHA1 2d408aa1d35661019c95adcc60b78c0727ed25b4
- SHA512 4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc
- SSDEEP 1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKuQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0JFV:OGsKYAI2p0WP9bDrJ7fak
- TLSH
  T1D493F8DDB2D1B06257BB21BD006F540FF236195D280D8850F129E8EABC74A499277FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $PLUGINSDIR/app/js/models/notifications.js
- Size 5KB
- SHA256 09529890b40777b01414003b702579409a62ceb225b4ab67b127ed01dd419269
- MD5 47d132f69bae5531f2614f376dff84ed
- SHA1 633932cb1b48301051e5e80d96d6946f5b451aed
- SHA512 3e6282ce7cc82981dbf8c71ebbb7b310a913d08d15f5b221e74eee99f79556fc0355621de716ad93add21b40eec19ece88dfc2225cf050173b07921ab832436b
- SSDEEP 96:sOr8u1s9FHYYdfHsW/GZwzpJGf8mui+U8QrGjqTxoOxoYsdfHsW/GZwvpZGNjINt:sGu9GYl3rNQ8K+JQC+N5Rsl3rxeEYIgO
- TLSH
  T176C1AA5F90BA00A3057293A809770241F66653AF49408CAF737C5EB44F311A6F4E6EDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $PLUGINSDIR/app/js/utils/analytics.js
- Size 5KB
- SHA256 0a3b80a0263691f71e85ec681be87229e6325a7d173ff430bbf4eb7fa355476c
- MD5 52b20797b4568fd9eaa065d676b7a344
- SHA1 a14cb0b575f2a7d274a78093d74906351b603dfa
- SHA512 f99786edcfc0220f1563617f40441f9b0ff02083be2c1847677b6533f7d1de16911227e349fe41e328800230bc2994b70db3ab79e4acef5fe07631e87aad0c5f
- SSDEEP 96:LlYkmHqqVHlnZrJGvt+QP2EZc8kukLQsO2LT+gObNSPgPgzauV:AHqSGV+kC9zNObNSPvzaA
- TLSH
  T1A9C199292469719068B373B68F5B1518EBB116233144E9223BBE87415FF6D02C693FCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/app/js/utils/commands.js
- Size 15KB
- SHA256 42091cedc15f51b1c8ef473e03fa5a5f9a3af51d523e0197360f084d9fb792db
- MD5 cc9d0e7975c08970d2b868c8d0d1e0ee
- SHA1 bb203ff45ddeabcb4fb232d0f63874e592c52b73
- SHA512 6a1ba2cbdc310d9baf26ce7a7c6b6c875b98f21afdcb9341ba1617b3211bef94097ff5bf572f6b244dbbf9308b9d4499446ffd3bc4636b728564faa4dcba7a2a
- SSDEEP 384:2Ur5Hs8cD+1uUPULQq06WCHp7Gvv9WqEWOnvsUmd:2MwGVd
- TLSH
  T16872DBAA68A721651933B73DDB9F0215FB33083B11465814BEED86917FF6402C2A6FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/app/js/utils/cookies.js
- Size 1KB
- SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
- MD5 6c60e675f8c8c68c0174b644d3a63a2a
- SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
- SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
- TLSH
  T17721E0087580D81EC5725739AE286778FD30992611C6D54DB88CA4F02F30C169DBE9FF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $PLUGINSDIR/app/js/utils/modal-events-delegate.js
- Size 1KB
- SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
- MD5 117e4fdbdb0ecf211c8bd909efd337d1
- SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
- SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
- TLSH
  T13C31D54D36FD173AE5B7172B5B2F5F8CAB72120B09054A26B2E69A804F354241196CFF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $PLUGINSDIR/app/js/utils/strings-loader.js
- Size 5KB
- SHA256 9b833f9e058ddb31ada44764449fe030f05e241dcefdef46886a74e30cd04ba5
- MD5 8ac781fa72423fc5c4c21a8c4138b709
- SHA1 50ad1d7f383d6801c57f916e46c1c17f79222725
- SHA512 f78558488968b1151b189545294a0bb97131c0a4d5dc0fa61ef168d999151e0f12af271389aae985d129adacfc6bf610b0191fb912ffdf8e97283829e2802604
- SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6Wfwk0lx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6WGe0muXDK0W
- TLSH
  T132B1ED58289354118C32B764CD935264ED6A4917023996F3FDEEC2686FB149E82F8FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/app/js/utils/utils.js
- Size 118B
- SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
- MD5 a0952ebeab701c05c75710c33d725e7e
- SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
- SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
- TLSH
  T1ADB01274B7AC73A2D315377AACBF6C1DF0375C368414B099B19034E19572D04519DCD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/app/js/windows/cri/cri-controller.js
- Size 5KB
- SHA256 8c8c3097f0b587d715e051f55894d73a0fb7b441024f47512fa340eb3f692152
- MD5 344b079e423000460dbcc623d3dea42f
- SHA1 6f7a6db5cdf0e4c511ae1ec8aa1f08dd9e79190c
- SHA512 15358d30f96ba6ec330417896ccd5c837e71b1712357185d7d84e60e8e6c21af52eadc1fcf61f6ce9a79165fab94813370a5ef0b632742043355ae3eb7eb6856
- SSDEEP 96:u6CeVFfOhETv5T6ToY/aq4bCWCtoQNxcGyUkeErscwn:u6jVtOyl2EY/aLmWCyQNxaUkrscwn
- TLSH
  T1BAC1DC9C7CF9866058B7277BCF160518E732420722426A2B7AFE83404FF5E404A16FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $PLUGINSDIR/app/js/windows/cri/template.js
- Size 1KB
- SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
- MD5 2f82acef2d339db31fab5c73edf8af19
- SHA1 d9138de6fe1320cd232fd6e1971fbbfdb9225bd6
- SHA512 90311035970edf2c1d0175c9b718c731fad4f58ad5a0b43a2588e2e6132cc09deff1d49328174408c51fe3082d62612f7a2a6c25179ac474101468ab68c2abcd
- TLSH
  T188212E24441C90331B7B979BDA13276CE9519301D80B7D3871AE43A82BF3B828E62359
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Network Share Discovery

Checks computer location settings

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32