Extracted

• • Target

    2025-02-01_8e0a909a89438175faf2ac7acf5e721b_magniber

  • Size

    357KB

  • MD5

    8e0a909a89438175faf2ac7acf5e721b

  • SHA1

    0ac18576c7634bdc07ef0576c38df8036a806c0b

  • SHA256

    91a543a24299a0dc22fbec348d090c4a0774f822440f58965ff38da77b82f0e0

  • SHA512

    15201efc7fd47c5f3c3d6ec108f2eaf970102e411014a59eaefe17cdd6011fd632310b9e86c1b7a611467bd598b3ca89cb379935f23b3ca7337ca678e232c23e

  • SSDEEP

    3072:KrfdSNN+V4Ji4GpMs/BE9PxGW5EdCeUsBRDFY9wIyZu9CwNwrGlXTDFarXEM2KPK:KE+VSuye7dCesaM7sqgrUgPOepQfX8A

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverypersistencespywarestealertrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2