Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-12-12_509031578c3adb4a0ebe9dd9699143d9_hijackloader_luca-stealer_magniber
-
Size
1.7MB
-
Sample
241212-mjx4xs1mbx
-
MD5
509031578c3adb4a0ebe9dd9699143d9
-
SHA1
47e9ade3330b49b069f840d6920833577e622dc1
-
SHA256
15c0a0572ff88f364e538034a6d69987f1c321c909e5b0b8604d353fad70fe65
-
SHA512
83e68977b8d472593cfa10d96f528e535db80359c7012a57da3ce0826e6b122c1127b16e6d10804b7f0fb6f881d8e7ec1887bddc431fd41a1dea61afdc77dab6
-
SSDEEP
49152:0jwq6y0TM5l+IbFk0kHHsOPwWVGG8S/Y1FtnLzAzAsmzv/////q0P39:XO5lPk0kHHp8OY1FtnLzAzAsmzv////F
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-12_509031578c3adb4a0ebe9dd9699143d9_hijackloader_luca-stealer_magniber.exe
Resource
win7-20241023-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
2024-12-12_509031578c3adb4a0ebe9dd9699143d9_hijackloader_luca-stealer_magniber
-
Size
1.7MB
-
MD5
509031578c3adb4a0ebe9dd9699143d9
-
SHA1
47e9ade3330b49b069f840d6920833577e622dc1
-
SHA256
15c0a0572ff88f364e538034a6d69987f1c321c909e5b0b8604d353fad70fe65
-
SHA512
83e68977b8d472593cfa10d96f528e535db80359c7012a57da3ce0826e6b122c1127b16e6d10804b7f0fb6f881d8e7ec1887bddc431fd41a1dea61afdc77dab6
-
SSDEEP
49152:0jwq6y0TM5l+IbFk0kHHsOPwWVGG8S/Y1FtnLzAzAsmzv/////q0P39:XO5lPk0kHHp8OY1FtnLzAzAsmzv////F
-
Modifies firewall policy service
-
Sality family
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Pre-OS Boot
1Bootkit
1