Sign In with your
Trend Micro Account
需要協助?
需要協助?

若您需要技術支援,請 按此建立案件。

Emerging threat on BKDR_LUMINOSITY

    • 更新於:
    • 30 Dec 2019
    • 產品/版本:
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan XG.All
    • Deep Security 9.6
    • Deep Security 10.0
    • ScanMail for Exchange 11.0
    • ScanMail for Exchange 12.0
    • InterScan Messaging Security Virtual Appliance 8.2
    • InterScan Messaging Security Virtual Appliance 8.5
    • InterScan Messaging Security Virtual Appliance 9.0
    • InterScan Messaging Security Virtual Appliance 9.1
    • InterScan Web Security Virtual Appliance 6.0
    • InterScan Web Security Virtual Appliance 6.5
    • ScanMail for IBM Domino 5.6 Linux
    • ScanMail for IBM Domino 5.6 Windows
    • Worry-Free Business Security Standard/Advanced 8.0
    • Worry-Free Business Security Standard/Advanced 9.0
    • ScanMail for Exchange 14.0
    • ScanMail for Exchange 12.5
    • 作業系統:
    • N/A N/A
概要

The name "LUMINOSITY" comes from its own builder named Luminosity Link. This builder allows actors to host a Luminosity Link server as well as generate customized binaries, which are compiled with .NET code. With this compiler, it is difficult to perform reverse engineering for the said customized binaries.

Costing roughly about US$40, this builder is very affordable to the actor, thus making it a dangerous threat both to organizations and individuals alike.

luminosity

Click image to enlarge.

VSAPI Pattern (Malicious File Detection)

LayerDetectionPattern BranchRelease Date
INFECTIONBKDR_LUMINOSITY.XOPR 12.9299/8/2016

WRS Pattern (Malicious URL and Classification)

LayerURLRatingRelease Date
EXPOSURE{blocked}45.35.190.47/invoice/proforma_invoice_pdf.exeMalware Accomplice11/14/2016
EXPOSUREgibsan.5gbfree{blocked}.com/horas/word.exeMalware Accomplice10/16/2016

AEGIS Pattern (Behavior Monitoring Pattern)

LayerDetectionPattern BranchRelease Date
DYNAMIC2730TOPR 16251/17/2017

DCT Pattern (System Clean Pattern)

LayerDetectionPattern BranchRelease Date
CLEAN-UPTSC_GENCLEANlatest DCT OPR(Built-in)
 
Make sure to always use the latest pattern available to detect old and new variants of LUMINOSITY.
詳情
Public

Solution Map

Major ProductsVersionsVirus PatternBehavior MonitoringWeb ReputationDCT PatternAntispam PatternNetwork Pattern

OfficeScan

10.6 and above












Update pattern via web console.



Update pattern via web console.












Enable Web Reputation Service*.




Update pattern via web console.

(not applicable)
Update pattern via web console.

Worry Free Business Suite
Standard
(not applicable)
Advanced/MSAUpdate pattern via web console.
Hosted

Deep Security

8.0 and above







(not applicable)

(not applicable)
Update pattern via web console.


ScanMail
SMEX 10 and later





(not applicable)


Update pattern via web console.



(not applicable)
SMD 5 and later
InterScan MessagingIMSVA 8.0 and above
InterScan WebIWSVA 6.0 and later

Deep Discovery
DDI 3.0 and later
(not applicable)
Update pattern via web console.
DDAN
DDEI
 
* Refer to the product Administrator’s Guide on how to enable the Email Reputation or Web Reputation services.

For further information, refer to the KB article on Recommendations on how to best protect your network using Trend Micro products.

Also visit Trend Micro's Threat Encyclopedia for further details on BKDR_LUMINOSITY.X.

Use this KB article to guide you in submitting suspicious or undetected virus for file analysis to Technical Support.

Premium
Internal
Partner
評價:
分類:
Troubleshoot; Remove a Malware / Virus; Update
解決方案ID:
1116755
評定這個解決方案
本文是否幫助解決您的問題?

感謝您的意見!


本意見調查系統為自動運作,將不會回覆如銷售、技術、產品等一般問題.

若您需要協助,請聯繫對應的技術支援窗口. 聯絡我們


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.