Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe
Resource
win7-20240708-en
General
-
Target
2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe
-
Size
11.0MB
-
MD5
1216b81c1f7b36aaad1ffed2c982fa2b
-
SHA1
cc05886a6bc38396431fba11b14ddf4b4c576aa9
-
SHA256
1702a224613323deeeba21fa405ec74979e7c6e474f2d5b11973ebf4e4155972
-
SHA512
1d5fd317b16ba48b66edac90f2cdbc3ff44a048a9e9f3d92417ea12d50ee8b0ab90e097abcbc4d318a1483eda10860845e6f462ee023a1e8190d7cf545179c39
-
SSDEEP
98304:mwIMFaSRnwIMFaSRcwIMFaSRfwIMFaSRIwIMFaSRQpFK0U8AmJNIo:7JRwJR5JRYJRtJRmFKzYN
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
xworm
3.1
23.26.201.172:8899
REaMgxQu68UQguvi
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 9 IoCs
resource yara_rule behavioral2/memory/2372-46-0x0000000000400000-0x00000000004CB000-memory.dmp family_xworm behavioral2/memory/2372-45-0x0000000000400000-0x00000000004CB000-memory.dmp family_xworm behavioral2/files/0x0009000000023c66-55.dat family_xworm behavioral2/memory/3744-122-0x0000000000A40000-0x0000000000A4E000-memory.dmp family_xworm behavioral2/memory/5008-233-0x0000000000400000-0x00000000004CB000-memory.dmp family_xworm behavioral2/memory/5008-348-0x0000000000400000-0x00000000004CB000-memory.dmp family_xworm behavioral2/memory/5008-347-0x0000000000400000-0x00000000004CB000-memory.dmp family_xworm behavioral2/memory/5008-355-0x0000000000400000-0x00000000004CB000-memory.dmp family_xworm behavioral2/memory/5008-379-0x0000000000400000-0x00000000004CB000-memory.dmp family_xworm -
Xred family
-
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3424 powershell.exe 4788 powershell.exe 412 powershell.exe 1456 powershell.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe -
Executes dropped EXE 5 IoCs
pid Process 3744 ._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 1968 Synaptics.exe 440 Synaptics.exe 5008 Synaptics.exe 5056 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3016 set thread context of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 1968 set thread context of 5008 1968 Synaptics.exe 113 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2412 schtasks.exe 3264 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1480 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 1456 powershell.exe 412 powershell.exe 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 1456 powershell.exe 412 powershell.exe 3744 ._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 1968 Synaptics.exe 4788 powershell.exe 3424 powershell.exe 1968 Synaptics.exe 1968 Synaptics.exe 1968 Synaptics.exe 3424 powershell.exe 4788 powershell.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe Token: SeDebugPrivilege 1456 powershell.exe Token: SeDebugPrivilege 412 powershell.exe Token: SeDebugPrivilege 3744 ._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe Token: SeDebugPrivilege 1968 Synaptics.exe Token: SeDebugPrivilege 3424 powershell.exe Token: SeDebugPrivilege 4788 powershell.exe Token: SeDebugPrivilege 5056 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3744 ._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 3016 wrote to memory of 412 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 91 PID 3016 wrote to memory of 412 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 91 PID 3016 wrote to memory of 412 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 91 PID 3016 wrote to memory of 1456 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 93 PID 3016 wrote to memory of 1456 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 93 PID 3016 wrote to memory of 1456 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 93 PID 3016 wrote to memory of 2412 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 95 PID 3016 wrote to memory of 2412 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 95 PID 3016 wrote to memory of 2412 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 95 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 3016 wrote to memory of 2372 3016 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 97 PID 2372 wrote to memory of 3744 2372 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 101 PID 2372 wrote to memory of 3744 2372 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 101 PID 2372 wrote to memory of 1968 2372 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 102 PID 2372 wrote to memory of 1968 2372 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 102 PID 2372 wrote to memory of 1968 2372 2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe 102 PID 1968 wrote to memory of 3424 1968 Synaptics.exe 106 PID 1968 wrote to memory of 3424 1968 Synaptics.exe 106 PID 1968 wrote to memory of 3424 1968 Synaptics.exe 106 PID 1968 wrote to memory of 4788 1968 Synaptics.exe 108 PID 1968 wrote to memory of 4788 1968 Synaptics.exe 108 PID 1968 wrote to memory of 4788 1968 Synaptics.exe 108 PID 1968 wrote to memory of 3264 1968 Synaptics.exe 110 PID 1968 wrote to memory of 3264 1968 Synaptics.exe 110 PID 1968 wrote to memory of 3264 1968 Synaptics.exe 110 PID 1968 wrote to memory of 440 1968 Synaptics.exe 112 PID 1968 wrote to memory of 440 1968 Synaptics.exe 112 PID 1968 wrote to memory of 440 1968 Synaptics.exe 112 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 1968 wrote to memory of 5008 1968 Synaptics.exe 113 PID 5008 wrote to memory of 5056 5008 Synaptics.exe 114 PID 5008 wrote to memory of 5056 5008 Synaptics.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rgrkFqQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rgrkFqQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAE60.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2412
-
-
C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3744
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rgrkFqQ.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rgrkFqQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF08A.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3264
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
PID:440
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1480
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.0MB
MD51216b81c1f7b36aaad1ffed2c982fa2b
SHA1cc05886a6bc38396431fba11b14ddf4b4c576aa9
SHA2561702a224613323deeeba21fa405ec74979e7c6e474f2d5b11973ebf4e4155972
SHA5121d5fd317b16ba48b66edac90f2cdbc3ff44a048a9e9f3d92417ea12d50ee8b0ab90e097abcbc4d318a1483eda10860845e6f462ee023a1e8190d7cf545179c39
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5faaf8941de4dc92e17137c5073de8312
SHA11e2a18d7b001b2ec612fe0561d8fe8da9b039526
SHA256915bd36f2d0929f0efd611d30621c374219acab9d19c620bb355dcf7299b5213
SHA512db604575f9360c2b5fefa6850bcb2c35c0005273a0e47ce6c1ee4e837b11f3e135d1e0f35a566f2cff2743690fac28cdf8800c110cda698f3c87a24bb6ff2ce8
-
Filesize
18KB
MD5dad57971f1672d91268bdf55825a7558
SHA134fc2667c12a858c205cc0992515da3433c27636
SHA256c97c0bbf402860cc799c2cacec861cd24341d54489d9cfd17b520073119d2375
SHA51252196ddda84207ad04ae1252da96c5813fd43d2f485c92f14e6fe3e9e130abb8835005b5d3396f9c581b5321983d4928fa3602f0318f868a092d8ad95eae2c1a
-
C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-20_1216b81c1f7b36aaad1ffed2c982fa2b_luca-stealer_magniber.exe
Filesize33KB
MD50201f6d2fa823471b937234b7ea29d6b
SHA1ee4e6d415a529e14381ebdf9a68347cdac57792d
SHA25676a1329afd87d9c83bff12bb13f73917aaef94e5729f0ef460078d2876337fdb
SHA512b9cad8c42d67b9854bfc8fe7b37fc6f7a39e59e556e8975eb26bd42de10c502fba8a848a04d8ef26679b6ffc8b7e22e1af1d46f1ddf85bda4fd35ef4c1cdfea4
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD594c6c53188027726b39cd1d4e68274be
SHA13efb1d1f29e45151fa89df9d5fd5d851db753e30
SHA2569e666787a3e1f509ff09b56689e9ef98b70579efe59e34372b62635f295aa3f6
SHA51232d327654150f9c4c6a520934ac1fb7180ac353da6ee6323176b5a0b6b7fbab8a590419eb644c33ff8faf08caf10cefb0148a45a367b16c40351f84b5bfa6eae