Extracted

• • Target

    2024-12-06_60f3667a13954c792397ec20707d486e_luca-stealer_magniber

  • Size

    3.0MB

  • MD5

    60f3667a13954c792397ec20707d486e

  • SHA1

    b266b7ab559571bbc21ac438d24ef31e37773554

  • SHA256

    f966cdc75955d093c38994150d9d5e801066690a18447aec1243acab475cc367

  • SHA512

    9526c31633eb07b6fa1ef271b20720b7a103061013320065ee5e8d63771d0b7a92c5639c22c2ed1d22b1f9e4483e694b823984345ff7b7de116609e20ecb129e

  • SSDEEP

    49152:GpAJ4K/kZCRW6JIAYtBRVXJT8IE8eDvkX6uPh0OR8/dJ388mS5vbv+fH2rJnLs5K:jdkyIAYt3VXneTkquPhO881Vv5Lndt

  Score

  10^/10

  discoverysalitybackdoorbootkitevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2