Overview

overview

9

Static

static

7

67bd874789...2a.zip

windows10-2004-x64

1

67bd874789...2a.zip

windows11-ltsc_2024-x64

1

Lucifer v2.88.exe

windows10-2004-x64

9

Lucifer v2.88.exe

windows11-ltsc_2024-x64

9

items.dat

windows10-2004-x64

3

items.dat

windows11-ltsc_2024-x64

3

pack.json

windows10-2004-x64

3

pack.json

windows11-ltsc_2024-x64

3

starter.exe

windows10-2004-x64

1

starter.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a.zip
  • Size 29.2MB
  • Sample261024-ssmmfact9p
  • SHA256 67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionthemidatrojan

Malware Config

Targets

    • Target
      67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a.zip
    • Size 29.2MB
    • SHA256 67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      Lucifer v2.88.exe
    • Size 15.5MB
    • SHA256 4abbfa8bcfffb4cb47dbba545a4e1b77e8c28bae0b987577b20ebbb79dbfacbd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

      defense_evasion
    behavioral3behavioral4
    • Target
      items.dat
    • Size 5.5MB
    • SHA256 84505c7acbfc4beb0704fe0f31b4f853f148f934fccd1c7d1c9b4945184d0a41
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      pack.json
    • Size 799B
    • SHA256 85fe64401bd55de7ba67126ddb5c35249d07567408d0b7dd651d88e159844134
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral7behavioral8
    • Target
      starter.exe
    • Size 14.7MB
    • SHA256 eac75a432bd5dbfbf89f8cdaad7a51b09a469d2ee6ce837af27ce04a7b7cbcb7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks