General
- Target Magicmida64.zip
- Size 7.8MB
- Sample260702-ry7zwsf15v
- SHA256 5baabec6faa91fa7c14b8c3b26d70ae3139ffe3e6ce7a9ba87c8228efdadb62f
Score
8/10
Malware Config
Targets
-
- Target Magicmida64.zip
- Size 7.8MB
- SHA256 5baabec6faa91fa7c14b8c3b26d70ae3139ffe3e6ce7a9ba87c8228efdadb62f
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target Magicmida64/HookLibraryx64.dll
- Size 19KB
- SHA256 d4b20eed23caebad7efa53e5f2f3c86d445864c2d3e43b343e01c8a9785e800e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Magicmida64/InjectorCLIx64.exe
- Size 776KB
- SHA256 211f7b804f1db43abddbb3dbdf41162d6cee76ae84e0bb38818cdbf4d07cf630
Score1/10 -
- Target Magicmida64/Magicmida.exe
- Size 4.0MB
- SHA256 9b3db16e9f8bbf1e84cb2a614304ac8c98efce62733102da96100e95b9fc9259
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Magicmida64/gmc.exe
- Size 6.4MB
- SHA256 702cd9cd792d35fa0cbd4e7dd3cd22acde680970384000e5c2c60f25e3fb8180
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Magicmida64/scylla_hide.ini
- Size 1KB
- SHA256 65e111ed64990551eaa0c8170276cdf0b6111eccbb09163d2d35ba344d48cc6a
Score1/10