Extracted

Extracted

Extracted

Extracted

• • Target

    magic.exe

  • Size

    36.7MB

  • MD5

    f921e16ca321bbe2e490f036f8b99c74

  • SHA1

    6e25638b340ba77f3e467bbbdc27c48209e193af

  • SHA256

    6b1700a3961f46120afdf3c5e027556682badcae0015503d533c9f808f214ddc

  • SHA512

    04492839ccaeeddc9090b7f6c6458294540bb3e2589108a3c459ae87a11c6cabe6548d80805f37b8bd43616d3645afdabe8b95b9f37c85c06f5c87b137a10274

  • SSDEEP

    786432:pjE3Qtst8rW8WZ2YwUlJAdQ/2j6+s7LWB75zuXVgM3MGYS2fAMJLjvZ:a3QtIoWlZ2mlq62qHWB75ilZMGJ24MRN

  Score

  10^/10

  berbewemotetmetasploitmodiloadermydoomepoch2backdoorbankerdefense_evasiontrojanupxworm

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Detects MyDoom family

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • Emotet payload

    Detects Emotet payload in memory.

    trojanbanker

  • ModiLoader Second Stage

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1