Overview

overview

9

Static

static

7

Magic.exe

windows7-x64

9

Magic.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    Magic.exe

  • Size

    7.8MB

  • Sample

    240825-rqr9gazhlp

  • MD5

    860bba2d171eb73f1fe26c011f0df590

  • SHA1

    ee534441d6d53e62e2d01e041cf44dec14bfb13a

  • SHA256

    2e5a524af482ba316ea6b4cbc97ac33d0314dd3d5111b9837b1d1934ca66a063

  • SHA512

    76486481cbef4ff21a7411720d14561f42dbcd9a1199a15c4bcf86e91f1dc92441b156576d359c38c1e2cce156ad4d36a804fbe363fbd92dc5c5369133085dbc

  • SSDEEP

    98304:Mo5r/y4Byi7IJ582DykskBN+BzdjrXeIZBf2LZ1W5EZ+DbaE3FB7yCH6H1bi6suf:R6fGGTykjvKZ/Xfay3FB7li1bfrHRWn4

Score
9/10
evasionexecutionthemidatrojan

Malware Config

Targets

    • Target

      Magic.exe

    • Size

      7.8MB

    • MD5

      860bba2d171eb73f1fe26c011f0df590

    • SHA1

      ee534441d6d53e62e2d01e041cf44dec14bfb13a

    • SHA256

      2e5a524af482ba316ea6b4cbc97ac33d0314dd3d5111b9837b1d1934ca66a063

    • SHA512

      76486481cbef4ff21a7411720d14561f42dbcd9a1199a15c4bcf86e91f1dc92441b156576d359c38c1e2cce156ad4d36a804fbe363fbd92dc5c5369133085dbc

    • SSDEEP

      98304:Mo5r/y4Byi7IJ582DykskBN+BzdjrXeIZBf2LZ1W5EZ+DbaE3FB7yCH6H1bi6suf:R6fGGTykjvKZ/Xfay3FB7li1bfrHRWn4

    Score
    9/10
    evasionexecutionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Stops running service(s)

      evasionexecution

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks