General
-
Target
2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber
-
Size
5.9MB
-
Sample
250307-zths7swwgs
-
MD5
ae78b25357fe235d510e80fdceb66236
-
SHA1
94f3276f301e2b58dea48f6ea7bc1c01d6213e30
-
SHA256
03e976dfc44285e2a1e2146fbc2e0d646c23d79d2897805489554cea45ebcf53
-
SHA512
dc9439e4108ae987b6db142191708aa20182a30d7cc7cc08beb83618088f8e5bea0d10552339abdde0c4f8785d9acd8f42541ed7660a6f8e21f072cf1711cbb5
-
SSDEEP
98304:e35z7PcMH5vfEyTLMetCLigFmdiwBYwAzWgcdJR30vjDwHujR/zWjFvnaNolt2sX:eJPhH5+LBmAwBYwAzOdJR3hHuV/zgFvT
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber.exe
Resource
win10v2004-20250217-en
Malware Config
Targets
-
-
Target
2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber
-
Size
5.9MB
-
MD5
ae78b25357fe235d510e80fdceb66236
-
SHA1
94f3276f301e2b58dea48f6ea7bc1c01d6213e30
-
SHA256
03e976dfc44285e2a1e2146fbc2e0d646c23d79d2897805489554cea45ebcf53
-
SHA512
dc9439e4108ae987b6db142191708aa20182a30d7cc7cc08beb83618088f8e5bea0d10552339abdde0c4f8785d9acd8f42541ed7660a6f8e21f072cf1711cbb5
-
SSDEEP
98304:e35z7PcMH5vfEyTLMetCLigFmdiwBYwAzWgcdJR30vjDwHujR/zWjFvnaNolt2sX:eJPhH5+LBmAwBYwAzOdJR3hHuV/zgFvT
-
Meduza Stealer payload
-
Meduza family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1