Overview

overview

8

Static

static

7

Lunar Clie...er.exe

windows10-2004-x64

8

Lunar Clie...er.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...p.html

windows10-2004-x64

3

$PLUGINSDI...p.html

windows11-ltsc_2024-x64

3

$PLUGINSDI...x.html

windows10-2004-x64

3

$PLUGINSDI...x.html

windows11-ltsc_2024-x64

3

$PLUGINSDI...app.js

windows10-2004-x64

3

$PLUGINSDI...app.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...uts.js

windows10-2004-x64

3

$PLUGINSDI...uts.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...dle.js

windows10-2004-x64

3

$PLUGINSDI...dle.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...min.js

windows10-2004-x64

3

$PLUGINSDI...min.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...ons.js

windows10-2004-x64

3

$PLUGINSDI...ons.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...ics.js

windows10-2004-x64

3

$PLUGINSDI...ics.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...nds.js

windows10-2004-x64

3

$PLUGINSDI...nds.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...ies.js

windows10-2004-x64

3

$PLUGINSDI...ies.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...ate.js

windows10-2004-x64

3

$PLUGINSDI...ate.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...der.js

windows10-2004-x64

3

$PLUGINSDI...der.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...ils.js

windows10-2004-x64

3

$PLUGINSDI...ils.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...ler.js

windows10-2004-x64

3

$PLUGINSDI...ler.js

windows11-ltsc_2024-x64

3

$PLUGINSDI...ate.js

windows10-2004-x64

3

$PLUGINSDI...ate.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Lunar Client - Installer.exe
  • Size 3.1MB
  • Sample261113-stxh2ac151
  • SHA256 f7c07f34771ed231852a5071c9e39d605dbf6928763c4fc13a605f66d421bf00
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Targets

    • Target
      Lunar Client - Installer.exe
    • Size 3.1MB
    • SHA256 f7c07f34771ed231852a5071c9e39d605dbf6928763c4fc13a605f66d421bf00
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/app/cmp.html
    • Size 5KB
    • SHA256 5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/app/index.html
    • Size 28KB
    • SHA256 40fb12107e50253d3004bc0f3ac4f977ad0d62d60c36f13a22c3b29d29b2e881
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/app/js/app.js
    • Size 25KB
    • SHA256 6447a5a50355823829b4c5f447346ab7a1bdf352f1ef5c0eaf33e7c2fcaceb5b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/app/js/block_inputs.js
    • Size 789B
    • SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/app/js/libs/cmp.bundle.js
    • Size 395KB
    • SHA256 4a2358230209d23a6197d0723c6b46f931371cda21ff7f0db39a6a1713bd04f3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
    • Size 90KB
    • SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/app/js/models/notifications.js
    • Size 5KB
    • SHA256 09529890b40777b01414003b702579409a62ceb225b4ab67b127ed01dd419269
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/app/js/utils/analytics.js
    • Size 7KB
    • SHA256 6f2d8337004d6de83bc0b61985c53b78fa35db7581740363250e18032afd2103
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      $PLUGINSDIR/app/js/utils/commands.js
    • Size 16KB
    • SHA256 36bfe80b5e33bd4a4c9146dc5b2a2e62445b008b1a6b03910c95fa59825554b8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19behavioral20
    • Target
      $PLUGINSDIR/app/js/utils/cookies.js
    • Size 1KB
    • SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      $PLUGINSDIR/app/js/utils/modal-events-delegate.js
    • Size 1KB
    • SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral23behavioral24
    • Target
      $PLUGINSDIR/app/js/utils/strings-loader.js
    • Size 5KB
    • SHA256 9b833f9e058ddb31ada44764449fe030f05e241dcefdef46886a74e30cd04ba5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral25behavioral26
    • Target
      $PLUGINSDIR/app/js/utils/utils.js
    • Size 959B
    • SHA256 97539ac4a2581a09d3e641c0e31e482afb94f894dd809b01c6a4d855f86cb76e
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral27behavioral28
    • Target
      $PLUGINSDIR/app/js/windows/cri/cri-controller.js
    • Size 7KB
    • SHA256 25189433050fd446dd3ab55709e5dec291468c7b230a2fc7c79b8eb0f980a29f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral29behavioral30
    • Target
      $PLUGINSDIR/app/js/windows/cri/template.js
    • Size 1KB
    • SHA256 016ef6ba4ccb64f2cbdf63357d180f0d3a5f74857633556b311eff57be8d023b
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Windows Management Instrumentation

2
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Direct Volume Access

1
T1006

Hide Artifacts

1
T1564

Ignore Process Interrupts

1
T1564.011

Modify Registry

3
T1112

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Network Share Discovery

1
T1135

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

upx
Score
7/10

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan
Score
8/10

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
6/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10