Extracted

Extracted

• • Target

    magic.exe

  • Size

    11.2MB

  • MD5

    2b6fa0f9cbe3f952fdb8177496461b53

  • SHA1

    64e03359c3dc40288fb3755dc3eb28f6c4e5090e

  • SHA256

    0e4c7ea1381577829677372822f13f5332f04047156d2e719e499c1546d0781e

  • SHA512

    e235cbab4dca4b9b11c6596670c8972c562129dfe44c4000cf3a3707d2f1dd7af6cccfe04527249de74cadb7483cc6d464d5b812fab9924dd4f0d59dcf1a52a8

  • SSDEEP

    196608:Vf3v86gVYibQQOOl2szsHFUK2r7UyTAdQmR8dA6lS8Qnf2ODjMnGydS8M9UprBOb:pWVHhZ2YsHFUK2JAdQJlaF3MnG38M9E

  Score

  10^/10

  berbewemotetfloxifgandcrabmodiloadervobfusepoch2backdoorbankerdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwaretrojanupxworm

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Vobfus

    A widespread worm which spreads via network drives and removable media.

    wormvobfus

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Detects Floxif payload

    backdoor

  • Emotet payload

    Detects Emotet payload in memory.

    trojanbanker

  • ModiLoader Second Stage

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  behavioral1