Extracted

• • Target

    2024-04-16_22cbc52d2fed8798d1d19e466c3ad974_magniber

  • Size

    4.1MB

  • MD5

    22cbc52d2fed8798d1d19e466c3ad974

  • SHA1

    ed4242e8d266a90c0d022c8764936a71accd1667

  • SHA256

    6e9d968723cdcb4d329e560820d30880fbfb2422ca254d128a30989efaa64543

  • SHA512

    c6535341198e6f66959c7fb43895e5f9f16e2a8cad9c1ab74f35db42cfbd8edaf771c30ba32030c514393e111d4f7d739eaab3665a68a62de3944e6adeb9d902

  • SSDEEP

    49152:KwkZwsIkuZyNQSJAhZLurjZI36en+stGmUI8PWzmnTiXjgQ6h+0yyP+kVhezlniZ:KwkZ3IPZbvirjZIl7ImqT0cQ6vj19J

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2