67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a.zip
- SHA256 67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a
Overview
overview
9Static
static
767bd874789...2a.zip
windows10-2004-x64
167bd874789...2a.zip
windows11-ltsc_2024-x64
1Lucifer v2.88.exe
windows10-2004-x64
9Lucifer v2.88.exe
windows11-ltsc_2024-x64
9items.dat
windows10-2004-x64
3items.dat
windows11-ltsc_2024-x64
3pack.json
windows10-2004-x64
3pack.json
windows11-ltsc_2024-x64
3starter.exe
windows10-2004-x64
1starter.exe
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Lucifer v2.88.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Lucifer v2.88.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
items.dat
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
items.dat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
pack.json
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
pack.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
starter.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
starter.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a.zip
- Size 29.2MB
- Sample261024-ssmmfact9p
- SHA256 67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a
- MD5 0b48160bd8eb38d4a300dc869fc5e4be
- SHA1 eb883003a551c1a6fc6bb528cb1180e646830f50
- SHA512 b16fc40d8a7301ada2815cd00ff5fbcc794c7aa0d9ab9bbd94186149423af641d3bc225774b0b941de7cab862450abbc239f0437c1e7aa534edc4efb6c889204
- SSDEEP 786432:1jDjn18SVIxCBi+ddA/1/Qx1c95nWPs/oBhrDTJlQSD:1j3gE0QnGks/oBhvdlQ8
- TLSH T107673356D50B56ED0DBE1AD16B0B9223B508CB2BB7436BBB7299C13D0AC1532B433F61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Lucifer v2.88.exe themida - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Lucifer v2.88.exe unpack001/starter.exe
File Explorer
-
67bd874789d234446811235fdb6a9cb9f7859b5e9d1e2da40e3993035fc40d2a.zip.zip 29.2MB
-
Lucifer v2.88.exe.exe 15.5MB
-
items.dat5.5MB
-
pack.json799B
-
starter.exe.exe 14.7MB
Lucifer v2.88.exe
- SHA256 4abbfa8bcfffb4cb47dbba545a4e1b77e8c28bae0b987577b20ebbb79dbfacbd
- MD5 ecdeee63290db25240531084e3377970
- SHA1 4fbdc20e481ea96752f39dffb7442cc536c85290
- SHA512 b3505f60894865ecf03fff2a0b1a1855dfc4b0565c21954193e8d3a052c39efd3336cde049e8b3d73ee22f904df332a931caef63a5cbff9df2d1ba0a6761b955
- SSDEEP 393216:h2bdmFqXufreSx4WIZNNez9oNZ1bZU14DcrlK:hkduqXIYWIbNDNZAnrU
- TLSH T131F6333B64127CF7EABD03F25D8AA41292A147450F431ABFB66FC6D75466B48CB33608
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
30900312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
2.9MB
Virtual Size
7.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
651KB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
32KB
Virtual Size
533KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
167KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
348KB
Virtual Size
601KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
24KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
18.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
11.3MB
Virtual Size
11.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=231, id=261, version=33145,
count=33, id=259, version=33145,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, version=2207,
count=7, id=253, version=35721,
count=12, id=259, version=35721,
count=20, id=260, version=35721,
count=108, id=261, version=35721,
count=48, id=260, version=33145,
count=28, productName=Unmarked objects (old),
count=695, id=260, version=35215,
count=30, id=257, version=33145,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=390, id=1, productName=Unmarked objects,
count=116, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
items.dat
- SHA256 84505c7acbfc4beb0704fe0f31b4f853f148f934fccd1c7d1c9b4945184d0a41
- MD5 b1348225305e9fa0ff3dc8f83079d824
- SHA1 d8bc2f8208affa89e1acc54b9c646d72089dcd91
- SHA512 8f9d0167d3bd43293186645d02d1d597cefedbdac3e953955cad48077ed938d6f33e934bf5e543027d559c29483718508d0e10903286f3a6a5f3c2c67e5ef052
- SSDEEP 49152:58M1tHOULAQP2UQgLcKC1dqmKI+B6Iz2acxC3EHMGk0L:iGYXHMGk0L
- TLSH T15046216BB51484B7E47810B32D09DAE6B761AC36DE1ADF67B484B33E7C7263D0923460
- MD5 SHA1 SHA512 SSDEEP TLSH
pack.json
- SHA256 85fe64401bd55de7ba67126ddb5c35249d07567408d0b7dd651d88e159844134
- MD5 2fe5d1bac994c0d0c6012b5dd3b6cf3b
- SHA1 16fcfb7db15e53b20e7890f6a0f803c838ce212f
- SHA512 bd6210f3e006db8edefc40240b05aceb21a547434e29699489052417bd673f0d68e591a90b75ac71c4e2142cd7a9fd04bfe7fc4318f6c181314f99f834197b81
- TLSH T1E8011D3ADA254D6A22FDA39CBD784F51D489236B42962C037C7C44CD5F368464A8AA2F
- MD5 SHA1 SHA512 TLSH
starter.exe
- IMPHASH f0fd92e7a28bdc96155e77c5c87bfc37
- SHA256 eac75a432bd5dbfbf89f8cdaad7a51b09a469d2ee6ce837af27ce04a7b7cbcb7
- MD5 37bdc6516ea91315c86baa033b38e449
- SHA1 20065af0b45bc4576411f1f1b14a6a1a112c9708
- SHA512 13129cb19e0e8dced51687b1dcdd1fb108d78ced733a9b5280504676f90cb0b6b54d762f24038c7ba548a743731fc86868e8a9ce9890f0d40d4402efa0b6f019
- SSDEEP 196608:xYn9oUglqlbTy822BG2cXNc35pC8axq0rUaJsjcBYfyn4HVgVvTfQCqbPnUleEmZ:xU3cUHGtYpBu/r79Eg9TfDqQleEmZ
- TLSH T1ABF6229A55D4827DC4418138E54546FAF0C5BC8C4DBDC82BFFC759266A30CAAC8EAF72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18836122
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpCrackUrl
bcrypt
BCryptGetProperty
crypt32
CryptStringToBinaryA
ole32
CoInitializeEx
oleaut32
SysStringLen
comctl32
ord413
shell32
CommandLineToArgvW
user32
SetWindowLongPtrW
gdi32
DeleteObject
advapi32
CheckTokenMembership
kernel32
IsValidLocale
Name
.text
Size
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.`M0
Size
Virtual Size
8.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.&QM
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tzn
Size
14.7MB
Virtual Size
14.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ