2024-01-06_19114ca95872da23952bba01edc216ea_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-01-06_19114ca95872da23952bba01edc216ea_magniber
Size

8.8MB
MD5

19114ca95872da23952bba01edc216ea
SHA1

c92fdb0cef3feec24d3c2d0acc5c77af45018062
SHA256

e190f0602f6d96f20bfeafb5239366db944ff8ab9c623c227bf9b3a7977a545c
SHA512

6e0af69a672b13fe5a9902fa26410ff612b3b86aa2ffa1791488aa19807f4ae9a8c79b02bfd25be34a9feb3d54fa7929e2f8eec428a3d8ad641fbf97cf8de411
SSDEEP

196608:0IRun8XiQqL9CYRJlhl6ZZCoUUds4AbuMCf6UAydaiGmhBBw:+8XiQqJNRJvl6ndULuMcbZhGQfw

Score

1^/10

Malware Config

Signatures

Files

2024-01-06_19114ca95872da23952bba01edc216ea_magniber
.exe windows:5 windows x86 arch:x86

5284b512497f4746b7e7bf3116e5d929

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4d:11:d5:80:ab:75:ed:f1:c6:25:3e:f2:39:b5:14:dc
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

13-10-2017 00:00

Not After

25-11-2020 23:59

Subject

CN=TeamSpeak Systems GmbH,O=TeamSpeak Systems GmbH,L=Krün,ST=Bayern,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b6:1a:f1:c5:93:a9:a2:f9:2f:5c:4c:1b:33:f5:01:5c:ec:4d:06:ac
Signer

Actual PE Digest

b6:1a:f1:c5:93:a9:a2:f9:2f:5c:4c:1b:33:f5:01:5c:ec:4d:06:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ts3_ssh

ssh_disconnect
ssh_message_channel_request_reply_success
ssh_message_reply_default
ssh_disconnect_with_message
ssh_message_get
ssh_set_message_callback
ssh_message_subtype
ssh_channel_free
ssh_message_auth_user
ssh_get_status
ssh_channel_window_size
ssh_set_blocking
ssh_handle_key_exchange
ssh_message_auth_reply_success
ssh_message_channel_request_open_reply_accept
ssh_free
ssh_message_channel_request_pty_height
ssh_message_auth_set_methods
ssh_channel_close
ssh_channel_read_timeout
ssh_message_auth_password
ssh_message_channel_request_pty_width
ssh_silent_disconnect
ssh_channel_write
ssh_message_free
ssh_blocking_flush
ssh_message_channel_request_pty_term
ssh_channel_set_blocking
ssh_message_type
ssh_channel_send_eof
ssh_options_set
ssh_new
create_host_rsa_key
ssh_bind_options_set
ssh_bind_accept_fd
ssh_init
ssh_bind_new
ssh_bind_free

dbghelp

MiniDumpWriteDump

gdi32

CreateFontIndirectA
DeleteObject
GetObjectA
SetTextColor

user32

PostQuitMessage
RegisterClassExA
SetForegroundWindow
TrackPopupMenuEx
LoadIconA
SendMessageA
TranslateMessage
CreateWindowExA
DestroyMenu
DefWindowProcA
GetCursorInfo
GetSubMenu
GetSystemMetrics
DestroyWindow
DispatchMessageA
GetMessageA
LoadMenuA
CreateDialogParamA
SetDlgItemTextA
SendDlgItemMessageA
SetDlgItemTextW
IsDialogMessageA
ShowWindow
PtInRect
GetSysColorBrush
GetDlgItem
SetCursor
ClientToScreen
LoadCursorA
GetWindowRect
LoadImageA
SetClipboardData
LoadBitmapA
EmptyClipboard
CloseClipboard
GetDlgItemTextA
OpenClipboard

advapi32

RegCloseKey
CryptEncrypt
CryptDecrypt
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
CryptDestroyKey
RegQueryValueExA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptSetKeyParam
CryptImportKey

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom

ws2_32

recv
send
WSAStartup
WSACleanup
WSAEnumProtocolsW
WSAGetLastError
htons
htonl
WSAAddressToStringW
ntohs
WSASetLastError
ntohl
setsockopt
ioctlsocket
getsockopt
WSARecv
getsockname
getpeername
WSASocketW
WSAStringToAddressW
listen
shutdown
WSASend
closesocket
bind
WSARecvFrom
WSASendTo
select
WSAIoctl
connect
accept
__WSAFDIsSet
freeaddrinfo
getaddrinfo
socket

shell32

Shell_NotifyIconA
SHGetFolderPathA
ShellExecuteA

mswsock

GetAcceptExSockaddrs
AcceptEx

secur32

InitSecurityInterfaceW

kernel32

ReadConsoleW
GetConsoleMode
GetConsoleCP
ExitThread
GetFileType
GetModuleHandleExW
ExitProcess
RtlUnwind
GetTimeFormatW
SetEnvironmentVariableW
GetStdHandle
FlushFileBuffers
ReadFile
GetDateFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
WaitForMultipleObjectsEx
SetStdHandle
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
InitializeSListHead
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
WriteConsoleW
OpenEventA
UnregisterWaitEx
HeapFree
GetCPInfo
GetStringTypeW
GetNativeSystemInfo
GetExitCodeThread
TryEnterCriticalSection
RaiseException
DecodePointer
EncodePointer
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ResetEvent
VirtualQueryEx
CreateSemaphoreW
FreeLibrary
CreateThread
LoadLibraryW
ResumeThread
GetProcessId
RtlCaptureContext
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
FormatMessageW
QueryPerformanceCounter
QueryPerformanceFrequency
AreFileApisANSI
CreateDirectoryExW
GetFileTime
CopyFileW
GetModuleHandleW
MoveFileExW
GetWindowsDirectoryW
GetCurrentDirectoryW
DeleteFileW
GetFileAttributesW
CreateFileW
GetEnvironmentVariableW
RemoveDirectoryW
GetModuleFileNameW
GetLastError
GetCurrentProcess
lstrlenA
GetCurrentThreadId
CreateFileA
CloseHandle
FreeConsole
lstrcpynA
GetCurrentProcessId
AllocConsole
SetUnhandledExceptionFilter
GetModuleHandleA
OutputDebugStringA
GlobalAlloc
GlobalLock
GlobalUnlock
GetSystemTimeAsFileTime
LocalFree
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
TlsAlloc
TlsFree
GetFileAttributesExW
SetEvent
WaitForSingleObjectEx
WideCharToMultiByte
CreateEventA
VirtualQuery
HeapAlloc
GetProcessHeap
SetWaitableTimer
TlsSetValue
VerifyVersionInfoA
SetLastError
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
WaitForSingleObject
MultiByteToWideChar
TerminateThread
QueueUserAPC
DeleteCriticalSection
VerSetConditionMask
VerifyVersionInfoW
TlsGetValue
CreateIoCompletionPort
GetSystemInfo
CreateEventW
CreateWaitableTimerA
SleepEx
LoadLibraryA
GetProcAddress
GetFileSizeEx
FindFirstFileA
ReleaseSemaphore
WriteFile
FindNextFileA
SetEndOfFile
FindClose
CreateMutexA
UnmapViewOfFile
DuplicateHandle
SwitchToThread
SetFilePointerEx
CreateFileMappingA
RemoveDirectoryA
CreateDirectoryA
CreateSemaphoreA
GetTickCount
MapViewOfFileEx
GetProcessTimes
ReleaseMutex
Sleep
CreateDirectoryW
FindFirstFileW
FindNextFileW
DeviceIoControl

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 812KB - Virtual size: 812KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 206KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5284b512497f4746b7e7bf3116e5d929

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4d:11:d5:80:ab:75:ed:f1:c6:25:3e:f2:39:b5:14:dcCertificate

Extended Key Usages

Key Usages

b6:1a:f1:c5:93:a9:a2:f9:2f:5c:4c:1b:33:f5:01:5c:ec:4d:06:acSigner

Headers

DLL Characteristics

File Characteristics

Imports

ts3_ssh

dbghelp

gdi32

user32

advapi32

crypt32

bcrypt

ws2_32

shell32

mswsock

secur32

kernel32

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 812KB - Virtual size: 812KB

.data Size: 3.4MB - Virtual size: 3.4MB

.rsrc Size: 70KB - Virtual size: 69KB

.reloc Size: 206KB - Virtual size: 206KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4d:11:d5:80:ab:75:ed:f1:c6:25:3e:f2:39:b5:14:dc
Certificate

b6:1a:f1:c5:93:a9:a2:f9:2f:5c:4c:1b:33:f5:01:5c:ec:4d:06:ac
Signer

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 812KB - Virtual size: 812KB

.data
Size: 3.4MB - Virtual size: 3.4MB

.rsrc
Size: 70KB - Virtual size: 69KB

.reloc
Size: 206KB - Virtual size: 206KB