2024-02-20_ae6b0d6747af6e8941e2b620daab8eae_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-02-20_ae6b0d6747af6e8941e2b620daab8eae_magniber
Size 3.5MB
Sample240220-gerhpacb4v
SHA256 4cb9f5674ec4597b651ee14c8999badaa76429f7c26ca81296b7c09569899ba9
MD5 ae6b0d6747af6e8941e2b620daab8eae
SHA1 229f177f2cc869755b9fdbeb885f35103de20162
SHA512 cdf410ff32d3aad3ce8a5289aa7fd0492ef99f3de53201ba13375e4bfc873404a44a837a42cb138ec96fd3142bc03da5ba59035bf4d626146bf27c3c10f61e01
SSDEEP 49152:UV7NOj20EwwqPPyvm1K61W6v/+HndvR/49IHY4v/:UFhwwil2Hndv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-20_ae6b0d6747af6e8941e2b620daab8eae_magniber

File Explorer

2024-02-20_ae6b0d6747af6e8941e2b620daab8eae_magniber

.exe 3.5MB

2024-02-20_ae6b0d6747af6e8941e2b620daab8eae_magniber

IMPHASH b32dab871b7de2bbeb9a52e51a2a7acd
SHA256 4cb9f5674ec4597b651ee14c8999badaa76429f7c26ca81296b7c09569899ba9
MD5 ae6b0d6747af6e8941e2b620daab8eae
SHA1 229f177f2cc869755b9fdbeb885f35103de20162
SHA512 cdf410ff32d3aad3ce8a5289aa7fd0492ef99f3de53201ba13375e4bfc873404a44a837a42cb138ec96fd3142bc03da5ba59035bf4d626146bf27c3c10f61e01
SSDEEP 49152:UV7NOj20EwwqPPyvm1K61W6v/+HndvR/49IHY4v/:UFhwwil2Hndv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

897066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\522315\out\Release\ComputerZTray.pdb

kernel32

GlobalUnlock GlobalFree GetShortPathNameW GetLongPathNameW ReleaseMutex lstrlenW CreateMutexW GetLogicalDriveStringsW QueryDosDeviceW MulDiv GetExitCodeProcess ResetEvent SystemTimeToTzSpecificLocalTime FileTimeToSystemTime OpenEventW OutputDebugStringW GetTempFileNameW RemoveDirectoryW SetFileAttributesW GetFileAttributesW CopyFileW MoveFileW MoveFileExW ExpandEnvironmentStringsW GlobalAddAtomW GlobalFindAtomW FindClose GetFullPathNameW FindFirstFileW FindNextFileW OutputDebugStringA GetFileSize FlushFileBuffers FormatMessageW GetSystemDirectoryW GetTempPathW CreateDirectoryW DeviceIoControl CreateFileW CreateFileMappingW UnmapViewOfFile MapViewOfFile SetFilePointer Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte GetVersionExW GetStartupInfoW CreateProcessW OpenMutexW CreateWaitableTimerW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetCurrentProcess GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW GlobalLock CancelWaitableTimer WaitForSingleObjectEx SetStdHandle SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetACP GetStdHandle GetModuleFileNameA ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread InterlockedFlushSList RtlUnwind TerminateThread DosDateTimeToFileTime FileTimeToDosDateTime FileTimeToLocalFileTime GetSystemTime SetFileTime GetFileTime SetEndOfFile InterlockedExchangeAdd QueryPerformanceCounter UnhandledExceptionFilter GetSystemWindowsDirectoryW FreeResource CreateFileA lstrcmpiA lstrcmpA GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent FindFirstFileExA GlobalAlloc LocalFileTimeToFileTime SystemTimeToFileTime WriteConsoleW SetWaitableTimer ResumeThread OpenProcess GlobalMemoryStatusEx GetVersion GetPrivateProfileIntW CreateEventW GetTickCount CloseHandle WritePrivateProfileStringW GetPrivateProfileStringW GetLocalTime IsBadReadPtr DeleteFileW GetCommandLineW LoadLibraryExW lstrcmpiW SetErrorMode SetUnhandledExceptionFilter GetCurrentProcessId VirtualProtect FreeLibrary InterlockedDecrement InterlockedIncrement DecodePointer LocalFree LocalAlloc PeekNamedPipe CreatePipe SetHandleInformation ReadFile WriteFile Sleep TerminateProcess ReadConsoleW GetFileAttributesExW WaitForMultipleObjects WaitForSingleObject SetEvent InitializeCriticalSectionAndSpinCount SetLastError GetLastError FindResourceExW FindResourceW GetModuleHandleW GetModuleFileNameW SizeofResource LoadResource DeleteCriticalSection InterlockedExchange LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCurrentThreadId LockResource MultiByteToWideChar LoadLibraryW RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetProcAddress InterlockedCompareExchange GetEnvironmentStringsW

user32

MonitorFromWindow SetFocus PostMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW FrameRect CreateWindowExW DestroyWindow GetWindowLongW SetWindowLongW LoadCursorW SendMessageTimeoutW RedrawWindow SetLayeredWindowAttributes LoadStringW UnregisterClassA WaitForInputIdle IsWindow FindWindowW wsprintfW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW ShowWindow CharNextW MessageBoxW OpenClipboard PtInRect EmptyClipboard SendNotifyMessageW SetTimer KillTimer GetDC ReleaseDC IsWindowVisible IsIconic SetForegroundWindow FindWindowExW GetWindowThreadProcessId GetSystemMetrics GetMenuStringW GetMenuItemInfoW DrawTextW SetRectEmpty IsDialogMessageW GetClassInfoExW SetCursor DrawFocusRect BeginPaint EndPaint EnableWindow SetWindowTextW SetActiveWindow SendMessageW CloseClipboard CopyRect SetRect OffsetRect FillRect GetSysColor MapWindowPoints GetWindowTextLengthW IsRectEmpty PostQuitMessage GetMenuInfo GetForegroundWindow GetWindowRect InvalidateRect IsWindowEnabled GetCursorPos WindowFromPoint GetDesktopWindow GetShellWindow GetClassNameW GetWindow GetFocus GetDialogBaseUnits GetDlgItem InflateRect ExitWindowsEx LoadIconW GetParent SetWindowRgn GetClientRect SetWindowPos UpdateLayeredWindow UnhookWinEvent SetWinEventHook GetWindowTextW ClientToScreen GetAncestor GetWindowInfo GetMonitorInfoW MonitorFromPoint SystemParametersInfoW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW

gdi32

MoveToEx SetTextColor SetBkMode SetDCPenColor SetBkColor LineTo GetStockObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW ExtTextOutW GetObjectW CreateDIBSection SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt EnumFontFamiliesW DeleteObject CreateFontW CombineRgn CreateRectRgn CreateSolidBrush SetViewportOrgEx GetTextMetricsW GetCurrentObject

advapi32

OpenSCManagerW GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW UnlockServiceDatabase StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey GetUserNameW CreateWellKnownSid GetLengthSid InitializeSecurityDescriptor SetSecurityDescriptorDacl DuplicateTokenEx SetTokenInformation RegEnumKeyExA RegOpenKeyExA RegQueryValueExA CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef RegEnumValueW

shell32

ShellExecuteW ShellExecuteExW CommandLineToArgvW ord165 SHLoadInProc Shell_NotifyIconW SHFileOperationW SHCreateDirectoryExW SHAppBarMessage SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal CLSIDFromProgID CoTaskMemFree CoTaskMemRealloc StringFromGUID2 CoCreateInstance CoInitializeSecurity CoUninitialize CoInitialize CoTaskMemAlloc CoInitializeEx CoSetProxyBlanket CoCreateGuid

oleaut32

VariantChangeType GetErrorInfo SysAllocString SetErrorInfo SysStringByteLen SysFreeString SysStringLen SysAllocStringByteLen CreateErrorInfo VarUI4FromStr VariantClear VariantInit

shlwapi

StrToIntExW SHGetValueA StrToIntW StrCmpNIW StrTrimA StrStrIA SHSetValueA PathIsDirectoryW PathCombineW PathFileExistsW SHGetValueW PathAppendW PathRemoveFileSpecW StrCmpIW PathIsRelativeW StrStrIW SHSetValueW PathFindFileNameW PathIsURLW PathIsRootW SHDeleteValueW AssocQueryStringW

comctl32

_TrackMouseEvent

ws2_32

__WSAFDIsSet WSAGetLastError socket closesocket connect ioctlsocket htons inet_addr recv select send

gdiplus

GdipCreateFontFamilyFromName GdipSetTextRenderingHint GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDrawImageRectRectI GdipDrawImageRectRect GdipDeleteFontFamily GdipCreateFromHDC GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDrawImagePointRectI GdipBitmapUnlockBits GdipDeleteGraphics GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipDrawImageRectI GdipDrawImagePointsI

secur32

GetUserNameExW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

EmptyWorkingSet GetModuleFileNameExW GetProcessImageFileNameW EnumProcesses

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

imm32

ImmDisableIME

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeGetTime timeBeginPeriod timeEndPeriod timeGetDevCaps PlaySoundW

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

generic

count=28, id=241, version=40116,

count=169, id=243, version=40116,

count=34, id=242, version=40116,

count=1, id=260, version=27031,

count=4, id=261, version=27032,

count=25, id=259, version=26706,

count=7, id=264, version=27045,

count=1, productName=Unmarked objects (old),

count=17, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=12, id=261, version=27031,

count=35, id=260, version=26706,

count=76, id=261, version=26706,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=506, id=1, productName=Unmarked objects,

count=78, id=261, version=27045,

count=1, id=255, version=27045,

count=1, id=151,

count=1, id=258, version=27045,