10dbc141e666a173f7ff229f16c344e4f1d04753e3f13df3d80d5f9235a4bae8

Sharing

Copy URL Twitter E-mail

General

Target
LunaExecutor.zip
Size 4.6MB
Sample261011-pgvxwsas5n
SHA256 10dbc141e666a173f7ff229f16c344e4f1d04753e3f13df3d80d5f9235a4bae8
MD5 e3bccdc6f05ab0f1c29914cdf0dd233f
SHA1 4debef39b111e4a3279fc2a7f5602260aa2217d8
SHA512 5e3d6889e36cde38aa195700f8f40ee6acf4e6f495820ed76ed21966bfd6d78b6d8fe9a9908f17e8e5509d0581174c710961404433dc6d1bd25c50dcfaad3e0d
SSDEEP 98304:EPDh/87eUXSUaqguwwys6BCEsU0OIZBiduze4TembDDDe8Gq:EPl/+XSUHrwzs2IZBTztTemb6y
TLSH
T1FF263309988823D2E0DFC6F251C90F685C366C664EB2E1A052D953BE3B5CD7CF6E7612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  LunaExecutor/Executor/Options.resx
- Size 140KB
- SHA256 19f5d9a06864007d5aec92c6650388ce6cc695bb3d3c54e3aafe5f6e84b34202
- MD5 226cc064e1041c4154225f2d907a11cd
- SHA1 69bb7fcd1bd253248610727c9af06d174cc02704
- SHA512 5f2fad4f331cb0b133860ac3fef91f9bb70d899f5d8504811e6cc797209c70467997b85bebd9da5ebf7b6c3131511c781436386c1c088659504e43fa66f4e32f
- SSDEEP 768:ZfWMnXOiWpdJa7tIyrKh/od7ZXNNUr5Zu+:ZfIiWpqJnfy
- TLSH
  T19EE34CF27D869EDB363608C94B083DB0FE645B97836DD404B88E7F745F488B098AD265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  LunaExecutor/Executor/Properties/Resources.Designer.cs
- Size 3KB
- SHA256 aa021c1cff6556f304103031bec5145f575d28fecf6550f4f63c1fc0806ffbc5
- MD5 909904edab009f0054c2e63e0ef541c3
- SHA1 267a2c18070625f6278396fa38a0c47deccf6127
- SHA512 b52acf0909de791517f92a3f55da3888268422e720734348962372d8663c2445ff56f0222820fa769bb4a00c155a5d2466161fbe563157959e2eb3336f9e1150
- TLSH
  T19F71EAB70FE6C2320821D4DB5704F851C7719153C63CDC28F8AF03689F9A34443ADAA9
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  LunaExecutor/Executor/Properties/Resources.resx
- Size 6KB
- SHA256 9f45fb0f6a9cc094e614922bc9b29b8ce0ca99967bf318137862b8bc2ad36c37
- MD5 9a7839c8be86269c7e41758c610a78cc
- SHA1 3152e17f9d3476fdea22edd689387ff2cebabf20
- SHA512 ae4903cc0f836f5083109b4bfec2d994f63fe2b5af0a364ccdbbf1816c840b00cc048930f74154850ab802ba2abe8d42539484c5681dc42d61da856c5a712ec9
- SSDEEP 192:Zf+tLPfYnLvFVOiFQaUD7UgHzokw9Xpokw9+:Zf+tLPQnLvDOiFQXD7UgTokw9Zokw9+
- TLSH
  T14CD16355B2D5DD250E930C3CD65138847BA8923F0234AC98B4DC961D9F53B82A7B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  LunaExecutor/Executor/ScriptHub.cs
- Size 4KB
- SHA256 17bc277525238e84d29b4792b420d0565e7a07991bf4a427459cfd00bbb28296
- MD5 424391fb512618dc1e6a0d1e60599dbb
- SHA1 c22d90a23c8d8de5057c4184514cb116430633eb
- SHA512 de7cde19c4c682a6fe18b469f1efa99442d78930b375799a0313057578887747d84e3baa1d82237dd2c1c3a10d0533a9bbaed6efba784fb7a93f0feed6092493
- SSDEEP 96:Jj4Y4GXzv26KV77r9sC0GDvqXa2MlRAMMPb+CGs:ij2+PnreC06yKDPdMPb+CGs
- TLSH
  T13D91E19C16EBD9754253A039DF9BC8462F63901B128DFC207A9F84D18F610285EB9F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  LunaExecutor/Executor/ScriptHub.resx
- Size 140KB
- SHA256 19f5d9a06864007d5aec92c6650388ce6cc695bb3d3c54e3aafe5f6e84b34202
- MD5 226cc064e1041c4154225f2d907a11cd
- SHA1 69bb7fcd1bd253248610727c9af06d174cc02704
- SHA512 5f2fad4f331cb0b133860ac3fef91f9bb70d899f5d8504811e6cc797209c70467997b85bebd9da5ebf7b6c3131511c781436386c1c088659504e43fa66f4e32f
- SSDEEP 768:ZfWMnXOiWpdJa7tIyrKh/od7ZXNNUr5Zu+:ZfIiWpqJnfy
- TLSH
  T19EE34CF27D869EDB363608C94B083DB0FE645B97836DD404B88E7F745F488B098AD265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  LunaExecutor/Executor/UI.cs
- Size 9KB
- SHA256 fdb325f9ac0755b31fd50f24359415db3d94577c2469d5e2bf0688a3a06ded34
- MD5 b3c05f018574aa07ec296fafba2b5581
- SHA1 2ac2a4b4a915cae3b48718f1eff4adfe3557bd24
- SHA512 2856d65fc69d32858ea9754ea2384096888fe311cb60a66f414c55e578465226e96ba775abd32c9e4aa0fc7c947811e5ef058b84ed07addc9bb980be8318d968
- SSDEEP 192:wjwGPSX09Bl2cpQPuXIT+Ujukgthcx0Cdm5dC39Cy+2nynKDPdMPb+CG15S83ECL:wjwsSOkcpQk2myxxdZF
- TLSH
  T16B120E0C59EBC5A50293607ADF87C08A2BA2405F178EFC357B9F85918F5102C5FB8B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  LunaExecutor/Executor/UI.resx
- Size 142KB
- SHA256 c41381171860d07d6fcc82106c7756560f54e79e8c8e2572bf5f8b07c02f9bc0
- MD5 2e963abdfa5e74a2eb17bffaa9d59382
- SHA1 4cae00cd40d990836573c85cce59cde4530d65b3
- SHA512 4a6b00121455b9364707ad208ad36cad1912fae09e7251511ec93811b5ef5158390c5c42fcd8ee364f0a21679bbe48f0b6e2805a1681ef28d8247b2a2d2a613d
- SSDEEP 768:ZfWMnXOiWg2dJa7tIyrKh/od7ZXNNUr5Zu+:ZfIiWPqJnfy
- TLSH
  T1EAE37EF17D869EDB363608C98B087EB0FE641B97836CD404B88E7F745F488B059AD265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  LunaExecutor/Luna.exe
- Size 8.0MB
- SHA256 6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a
- MD5 53648dee77c997e3665a8c3add00eeaa
- SHA1 dfeedc4eae6c517ef1286bd041cc36de8a608f46
- SHA512 598afff16262ee75f9866a62a124407c6ef5dff8c577371ea79ea8817805be998ba6d0553497400312c1cf5c0106772696727f312bd55ac99a8c23dd6e138f65
- SSDEEP 98304:V3T2h9PPeJzgg3ty1qrMGUjEBoSMeduU8gsHZVY/YK2:VjigJMg3E1qwQFM/U8gsHCYX
- TLSH
  T1FC867C43EC9159E9C1A9A33089A79253BB71BC481B3223D72B90F7392F76BD06E75350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery execution spyware stealer
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral15 behavioral16