Loading malware…
27 distinct techniques documented for this family, organized by ATT&CK tactic.
T1059.003 — Command and Scripting Interpreter: Windows Command Shell (Execution)
Direct syscalls (SSN resolution from ntdll.dll)
majinSvc — Windows service name registered for persistence; The binary can run as a Windows service and supports several operational flags: --service
It creates a BMP wallpaper ... and forces it via two registry locations: HKCU\Control Panel\Desktop → Wallpaper + WallpaperStyle; HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System → Wallpaper
majinSvc — Windows service name registered for persistence
T1055 — Process Injection (Defense Evasion)
majinSvc — Windows service name registered for persistence
Stack strings + XOR obfuscation
Dynamic API resolution via PE export parsing
T1055 — Process Injection (Defense Evasion)
clears event logs ... Event log clearing ... USN journal deletion (fsutil usn deletejournal)
Delay execution and language/geo checks (GetKeyboardLayoutList, GetUserGeoID)
It creates a BMP wallpaper ... and forces it via two registry locations: HKCU\Control Panel\Desktop → Wallpaper + WallpaperStyle; HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System → Wallpaper
Processus ciblés : Carbon Black, CrowdStrike Falcon, FortiEDR, SentinelOne, Cylance, Microsoft Defender for Endpoint, Qualys, Tanium, Veeam, Backup Exec, Acronis
Destruction de sauvegardes : suppression des VSS, désactivation de la restauration système, effacement des journaux d’événements, suppression du journal USN
Le groupe utilise Mimikatz et Advanced IP Scanner dans ses opérations.
Targeted processes (partial list): Carbon Black, CrowdStrike Falcon, FortiEDR, SentinelOne, Cylance, Microsoft Defender for Endpoint, Qualys, Tanium, Veeam, Backup Exec, Acronis, and many others.
Vérifications géographiques : GetKeyboardLayoutList , GetUserGeoID
Delay execution and language/geo checks (GetKeyboardLayoutList, GetUserGeoID)
Vérifications géographiques : GetKeyboardLayoutList , GetUserGeoID
language/geo checks (GetKeyboardLayoutList, GetUserGeoID)
ADMIN$\Temp\majin.exe — Dropped via admin share for remote execution
T1005 — Data from Local System (Collection)
A copy of your internal data was extracted during the process.
T1567 — Exfiltration Over Web Service (Exfiltration)
Aggressively deletes volume shadow copies, disables recovery/boot options, clears event logs, and disables hibernate/System Restore so the victim cannot easily roll back.
Files are locked and appended the extension .MAJIN; Files are encrypted using AES-256; Files were encrypted where they sat. A unique key per file, wrapped under an offline key that leaves with us when this is over.
Process termination of security and backup tools; Service stopping
Shadow copy deletion (vssadmin delete shadows /all /quiet); Boot configuration changes (bcdedit); System restore disable via WMI; disables hibernate/System Restore so the victim cannot easily roll back.
Majin generates a custom full-screen lock screen using GDI ... It creates a BMP wallpaper ... and forces it via two registry locations
Wallpaper hijacking : BMP 1920×1080 via double chemin registre (HKCU + HKLM)
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.