Advanced Plus Security L0ckJaw - New Laptop Config 2022

[cruelsister]

A new batch of Magniber's are out, and these with a new and improved valid (so far) certificate:

 

[upnorth]

Please do not post asking for types of Malware, these posts/threads will be removed.

 

[Shadowra]

A new batch of Magniber's are out, and these with a new and improved valid (so far) certificate:

View attachment 267658

Hello Meghan
Can you send me the sample so I can study it? (in PM)

 

[Asterixpl]

Sorry

 

[SeriousHoax]

View attachment 267655
Norton vs the new Magniber sample .. detected Immediately

VirusTotal

VirusTotal

www.virustotal.com

Thanks @Shadowra for the sample

Trojan.Gen.MBT is only a hash based signature, if I remember correctly. Try changing the hash and see if it can stop it.
Edit: The sample is from 21st June. Products like Avast, MD, BD missed it initially. MD added detection after my submission. But these signatures are not as good as Kaspersky and ESET's. ESET also blocks the certificate. So any malware with this certificate will also be blocked. That's why you see ESET on VT shows "Multiple Detection". One for their "A Variant Of Win64/Injector.xx" heuristics and one for the blacklisted signature "Win32/GenCBL.CGI trojan".
I'm pretty sure Norton would've missed it initially also till they added this hash based detection because I think Norton hasn't added behavior/heuristic based detection capability for Magniber yet.

 

[Shadowra]

Trojan.Gen.MBT is only a hash based signature, if I remember correctly. Try changing the hash and see if it can stop it.

We should see if Norton detected the file or if they did a HEUR or Hexa detection...
I'm on vacation, I can't check by changing its hash....

 

[SeriousHoax]

We should see if Norton detected the file or if they did a HEUR or Hexa detection...
I'm on vacation, I can't check by changing its hash....

I added some extra line in my previous comment.

 

[L0ckJaw]

Back to G DATA …