Overview

overview

9

Static

static

1

2024-04-17...er.exe

windows7-x64

9

2024-04-17...er.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-17_a160fa14ae6122d05b508ad8ca8b65f8_mafia_magniber

  • Size

    7.2MB

  • Sample

    240417-nhx8zaeg8s

  • MD5

    a160fa14ae6122d05b508ad8ca8b65f8

  • SHA1

    4b3cc9a8ffa48b81d595e7dc2aebb8edbb33f16a

  • SHA256

    98906f72ecef56cec85b9e9ab9e626b3a300d12b94fa3483058eedafeccc80b0

  • SHA512

    ba0ef150b474135bbd4a6040a902e70a386078f63ba3531ba2076224d05122de8b12ca3ec985570650d98aa9bc69cfbf88c910ab862e06b54b14927a6519fe49

  • SSDEEP

    196608:CoTZvEvmyX/rboITFerHWrKVo1wRuNBuyRMvypdW:CEEvmyX/rbtTFeYAEuyRMapA

Score
9/10
discoverypersistenceransomware

Malware Config

Targets

    • Target

      2024-04-17_a160fa14ae6122d05b508ad8ca8b65f8_mafia_magniber

    • Size

      7.2MB

    • MD5

      a160fa14ae6122d05b508ad8ca8b65f8

    • SHA1

      4b3cc9a8ffa48b81d595e7dc2aebb8edbb33f16a

    • SHA256

      98906f72ecef56cec85b9e9ab9e626b3a300d12b94fa3483058eedafeccc80b0

    • SHA512

      ba0ef150b474135bbd4a6040a902e70a386078f63ba3531ba2076224d05122de8b12ca3ec985570650d98aa9bc69cfbf88c910ab862e06b54b14927a6519fe49

    • SSDEEP

      196608:CoTZvEvmyX/rboITFerHWrKVo1wRuNBuyRMvypdW:CEEvmyX/rbtTFeYAEuyRMapA

    Score
    9/10
    discoverypersistenceransomware

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Detects executables containing possible sandbox analysis VM usernames

    • Renames multiple (595) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks