Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Emerging threat on BKDR_LUMINOSITY

    • Updated:
    • 23 Feb 2017
    • Product/Version:
    • Deep Security 10.0
    • Deep Security 9.6
    • InterScan Messaging Security Virtual Appliance 8.2
    • InterScan Messaging Security Virtual Appliance 8.5
    • InterScan Messaging Security Virtual Appliance 9.0
    • InterScan Messaging Security Virtual Appliance 9.1
    • InterScan Web Security Virtual Appliance 6.0
    • InterScan Web Security Virtual Appliance 6.5
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan XG.All
    • ScanMail for Exchange 11.0
    • ScanMail for Exchange 12.0
    • ScanMail for IBM Domino 5.6 Linux
    • ScanMail for IBM Domino 5.6 Windows
    • Worry-Free Business Security Standard/Advanced 8.0
    • Worry-Free Business Security Standard/Advanced 9.0
    • Platform:
    • N/A N/A
Summary

The name "LUMINOSITY" comes from its own builder named Luminosity Link. This builder allows actors to host a Luminosity Link server as well as generate customized binaries, which are compiled with .NET code. With this compiler, it is difficult to perform reverse engineering for the said customized binaries.

Costing roughly about US$40, this builder is very affordable to the actor, thus making it a dangerous threat both to organizations and individuals alike.

luminosity

Click image to enlarge.

VSAPI Pattern (Malicious File Detection)

LayerDetectionPattern BranchRelease Date
INFECTIONBKDR_LUMINOSITY.XOPR 12.9299/8/2016

WRS Pattern (Malicious URL and Classification)

LayerURLRatingRelease Date
EXPOSURE{blocked}45.35.190.47/invoice/proforma_invoice_pdf.exeMalware Accomplice11/14/2016
EXPOSUREgibsan.5gbfree{blocked}.com/horas/word.exeMalware Accomplice10/16/2016

AEGIS Pattern (Behavior Monitoring Pattern)

LayerDetectionPattern BranchRelease Date
DYNAMIC2730TOPR 16251/17/2017

DCT Pattern (System Clean Pattern)

LayerDetectionPattern BranchRelease Date
CLEAN-UPTSC_GENCLEANlatest DCT OPR(Built-in)
 
Make sure to always use the latest pattern available to detect old and new variants of LUMINOSITY.
Details
Public

Solution Map

Major ProductsVersionsVirus PatternBehavior MonitoringWeb ReputationDCT PatternAntispam PatternNetwork Pattern

OfficeScan

10.6 and above












Update pattern via web console.



Update pattern via web console.












Enable Web Reputation Service*.




Update pattern via web console.

(not applicable)
Update pattern via web console.

Worry Free Business Suite
Standard
(not applicable)
Advanced/MSAUpdate pattern via web console.
Hosted

Deep Security

8.0 and above







(not applicable)

(not applicable)
Update pattern via web console.


ScanMail
SMEX 10 and later





(not applicable)


Update pattern via web console.



(not applicable)
SMD 5 and later
InterScan MessagingIMSVA 8.0 and above
InterScan WebIWSVA 6.0 and later

Deep Discovery
DDI 3.0 and later
(not applicable)
Update pattern via web console.
DDAN
DDEI
 
* Refer to the product Administrator’s Guide on how to enable the Email Reputation or Web Reputation services.

For further information, refer to the KB article on Recommendations on how to best protect your network using Trend Micro products.

Also visit Trend Micro's Threat Encyclopedia for further details on BKDR_LUMINOSITY.X.

Use this KB article to guide you in submitting suspicious or undetected virus for file analysis to Technical Support.

Premium
Internal
Rating:
Category:
Troubleshoot; Remove a Malware / Virus; Update
Solution Id:
1116755
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.