Extracted

Extracted

• • Target
    2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber
  • Size 36.9MB
  • SHA256 a655972465abe6c421e649aee9cfc22154c56e49806d9922384b9219dfd1175c
  • MD5 f7ebfd5e206742254f9a8d8f0cd1d992
  • SHA1 a9e4c77843ed428a3907117b4eef602f5496cbe9
  • SHA512 716e1df25721e2f3dfcc1e1db137fd82c3f8bb3f1f01bae0c506fa1fb0edf5e534166cf2c737f0318379f54172e5a5a90f911015d09a3a0b3916291b15fa2cdd
  • SSDEEP 786432:Je/PLPAeNZZLmkE0hL46/O6lrBxndaQMIJcWUKA6qoEbeBKbB1lKfh+vq5/N:JkL1Zhx/DxnoQMIJo6qjJcfsS51
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratquasarxmrigdefaultmozillaupgradeevasionminerpersistenceratspywaretrojanupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Async RAT payload

    rat

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing common artifacts observed in infostealers

  • Detects file containing reversed ASEP Autorun registry keys

  • UPX dump on OEP (original entry point)

  • XMRig Miner payload

    miner

  • Blocklisted process makes network request

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2