NEW_Luna.rar
- SHA256 d95ab0ef265ed2fc67bb59cf776f75f013f79311df59407b3d644e14ce99b7ea
| resource | yara_rule |
|---|---|
| static1/unpack001/_reference/strings.csv | family_meduza |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/BASE/HYPERION_DUMP_V-9ac8595712b447a7/Hyperion.pss.bin |
| unpack001/BASE/HYPERION_DUMP_V-9ac8595712b447a7/hyperion.dih.bin |
| unpack001/BASE/_EvolveInternal/EarlyLoader/bin/EarlyLoader.exe |
| unpack001/BASE/_EvolveInternal/EarlyLoader/bin/Module.dll |
| unpack001/BASE/_EvolveInternal/EvolveInternal/bin/x64/Release/Module.dll |
| unpack001/_audit/live_image.bin |
| unpack001/_probe/module.dll |
| unpack001/_probe/probe.dll |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=172, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=93, id=261, version=35207,
count=3, id=257, version=33145,
count=164, id=1, productName=Unmarked objects,
count=1, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=30, id=261, version=35207,
count=6, id=257, version=35207,
count=33, id=257, version=33145,
count=586, id=1, productName=Unmarked objects,
count=12, id=260, version=34120,
count=125, id=260, version=33519,
count=38, id=261, version=34436,
count=1, id=259, version=34436,
count=90, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=30, id=261, version=35207,
count=6, id=257, version=35207,
count=33, id=257, version=33145,
count=585, id=1, productName=Unmarked objects,
count=12, id=260, version=34120,
count=125, id=260, version=33519,
count=38, id=261, version=34436,
count=1, id=259, version=34436,
count=90, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
Unsigned PE
Checks for missing Authenticode signature.
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=262, version=29395,
count=38, id=257, version=29395,
count=35, id=259, version=29395,
count=219, id=261, version=29395,
count=113, id=260, version=29395,
count=7, id=253, version=28518,
count=19, id=260, version=30034,
count=18, id=259, version=30034,
count=1, id=261, version=32595,
count=117, id=261, version=30034,
count=145, id=261, version=30154,
count=1032, id=1, productName=Unmarked objects,
count=5, id=259, version=30154,
count=903, id=260, version=30154,
count=82, productName=Unmarked objects (old),
count=1, id=255, version=30154,
count=8325, id=265, version=30154,
count=1, id=256, version=30154,
count=1, id=258, version=30154,
Unsigned PE
Checks for missing Authenticode signature.
count=147, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=3, id=257, version=33145,
count=98, id=1, productName=Unmarked objects,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=32, id=261, version=35207,
count=1, id=261, version=35228,
count=1, id=258, version=35228,
Unsigned PE
Checks for missing Authenticode signature.
count=147, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=3, id=257, version=33145,
count=98, id=1, productName=Unmarked objects,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=32, id=261, version=35207,
count=1, id=261, version=35228,
count=1, id=258, version=35228,
Meduza Stealer payload