Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 998128" data-attributes="member: 32260">SWH vs. Magniber CPL variant[URL unfurl=&quot;false&quot;]https://www.socinvestigation.com/magniber-ransomware-payload-extension-changed-detection-response/[/URL]The infection chain:&nbsp;typosquatting --&gt; malicious website ---&gt; Magniber downloaded directly as CPL file or in ZIP archive ---&gt; user opens CPL file (Magniber is executed via LOLBins: control.exe &amp; rundll32.exe)SWH blocks by default opening CPL files (SRP restrictions). But, the rest will depend on the user. Magniber is often promoted as a digitally signed update/upgrade, so many users can be fooled to turn off the protection. This is probable especially when they are looking for pirated content. Anyway, the false alarms for updates/upgrades are very low with SWH settings, so many users can be also suspicious about these updates/upgrades. In such rare &amp; unclear situations, the best solution is to wait one day (or more). In most cases, the AVs are able to correctly recognize threats after one day.</blockquote>

[QUOTE="Andy Ful, post: 998128, member: 32260"] [B][SIZE=5]SWH vs. Magniber CPL variant[/SIZE][/B] [URL unfurl="false"]https://www.socinvestigation.com/magniber-ransomware-payload-extension-changed-detection-response/[/URL] [B]The infection chain:[/B] [B][COLOR=rgb(0, 168, 133)]typosquatting --> malicious website ---> Magniber downloaded directly as CPL file or in ZIP archive[/COLOR] ---> [COLOR=rgb(184, 49, 47)]user opens CPL file (Magniber is executed via LOLBins: control.exe & rundll32.exe)[/COLOR] SWH blocks by default opening CPL files (SRP restrictions).[/B] But, the rest will depend on the user. Magniber is often promoted as a digitally signed update/upgrade, so many users can be fooled to turn off the protection. This is probable especially when they are looking for pirated content. Anyway, the false alarms for updates/upgrades are very low with SWH settings, so many users can be also suspicious about these updates/upgrades. In such rare & unclear situations, the best solution is to wait one day (or more). In most cases, the AVs are able to correctly recognize threats after one day. [/QUOTE]

Verification