2024-02-23_6b2fa566baa69c2f6771ccc8bcfb7a11_magniber_metamorfo_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-23_6b2fa566baa69c2f6771ccc8bcfb7a11_magniber_metamorfo_revil
Size

60.4MB
MD5

6b2fa566baa69c2f6771ccc8bcfb7a11
SHA1

58565b6c23ca8731982a6e241acb95bb84041294
SHA256

320417d839a30ba95c47bdac599897ed2bdd59a469b39e908d47c0ffca053889
SHA512

4aaa40025e6082099d8fc4ab115fa6cccba9388120fb0129bc0871451fed5158f96dbce26f3042c216c1288f80ed9cc7be14abd5850f48df356350fd490c6f82
SSDEEP

786432:pIOpinGbGsMv5DNHxnTk0ASunI9x8T4JvAn8VUFm5TvNye5yL5I/4BuS2d5NANiL:Yer85xRbFU4JWvHVIOldGg5am4VT

Score

1^/10

Malware Config

Signatures

Files

2024-02-23_6b2fa566baa69c2f6771ccc8bcfb7a11_magniber_metamorfo_revil
.exe windows:5 windows x86 arch:x86

f2d9e8e24991c40d3a4c8dac0c1f0036

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:25:cd:86:06:d0:ee:31:a7:8c:2d:40
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/09/2023, 07:18

Not After

21/11/2024, 02:47

Subject

SERIALNUMBER=91510100MAACMR9234,CN=四川征云网络科技有限公司,OU=研发部,O=四川征云网络科技有限公司,L=Chengdu,ST=Sichuan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13074368656e676475,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:ab:b3:3f:ae:ad:fa:40:55:e5:06:e1:60:07:cb:1d:dc:a7:18:fb:89:19:b9:de:a6:2c:0a:2b:1e:89:8c:6f
Signer

Actual PE Digest

b1:ab:b3:3f:ae:ad:fa:40:55:e5:06:e1:60:07:cb:1d:dc:a7:18:fb:89:19:b9:de:a6:2c:0a:2b:1e:89:8c:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\code\yebaoinstall\outputak\AKInstall.pdb

Imports

ws2_32

setsockopt
ntohs
htons
socket
getsockname
getpeername
connect
bind
WSAGetLastError
closesocket
recv
WSASetLastError
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
shutdown
getnameinfo
getaddrinfo
freeaddrinfo
WSACleanup
recvfrom
sendto
ntohl
getsockopt
gethostbyname
select
WSAStringToAddressW
WSAStartup
inet_addr
send
WSAAddressToStringW
inet_ntoa
WSAIoctl
gethostname

kernel32

GetEnvironmentVariableW
DeviceIoControl
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
CreatePipe
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetCurrentThreadId
GetVersionExW
GetSystemDirectoryW
FreeResource
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
GetFileAttributesExW
Process32NextW
GetDiskFreeSpaceExW
LockResource
DeleteFileW
Process32FirstW
CloseHandle
SetEndOfFile
WriteConsoleW
GetFullPathNameA
GetCurrentDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
HeapSize
SetConsoleCtrlHandler
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetACP
GetModuleFileNameA
ExitProcess
HeapReAlloc
GetModuleHandleExW
ResumeThread
ExitThread
RtlUnwind
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
FormatMessageA
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
SetFilePointer
GetFileSize
SetFileAttributesW
SetFileTime
GlobalUnlock
GlobalLock
GlobalFree
CreateMutexW
IsBadReadPtr
GetModuleHandleA
LoadLibraryA
GetVersionExA
GetLocalTime
GetTickCount
MulDiv
GetFullPathNameW
SetLastError
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapDestroy
HeapCreate
FlushInstructionCache
MultiByteToWideChar
InterlockedIncrement
WideCharToMultiByte
OutputDebugStringW
InterlockedDecrement
OutputDebugStringA
GetProcessTimes
MoveFileW
GetSystemTime
GetTempFileNameW
CopyFileW
FreeLibrary
GetModuleHandleW
GlobalAlloc
LocalFree
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
IsDebuggerPresent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ConvertThreadToFiber
CreateEventW
QueryPerformanceFrequency
QueryPerformanceCounter
EncodePointer
GetStringTypeW
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
FormatMessageW
RaiseException
LoadLibraryW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
SetCurrentDirectoryW
CreateProcessW
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcess
FindNextFileW
HeapFree
FindFirstFileW
SizeofResource
ReadFile
GetCurrentProcessId
DeleteCriticalSection
MoveFileExW
GetProcAddress
GetStartupInfoW
CreateDirectoryW
RtlCaptureStackBackTrace
lstrlenA
WriteFile
ReadConsoleA
SetConsoleMode
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread

user32

DestroyCursor
InvertRect
FillRect
EqualRect
PostQuitMessage
EnableWindow
IsWindowEnabled
SetActiveWindow
GetDesktopWindow
CharNextW
DestroyIcon
GetIconInfo
TrackMouseEvent
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
GetDC
PtInRect
IsWindow
IsRectEmpty
OffsetRect
IntersectRect
InflateRect
SetFocus
DrawIconEx
UnionRect
EndPaint
InvalidateRect
SetWindowTextW
GetCursorPos
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
GetClassNameW
LoadBitmapW
CreateIconFromResource
LoadImageW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
EnableMenuItem
SetRect
KillTimer
SetTimer
SetCursor
GetKeyState
BeginPaint
GetFocus
CopyRect
GetMonitorInfoW
MonitorFromWindow
LoadCursorW
GetWindow
GetProcessWindowStation
GetUserObjectInformationW
GetSysColor
GetSystemMetrics
MessageBoxW
LoadIconW
GetWindowPlacement
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowRect
ReleaseDC
SetForegroundWindow
GetClientRect
EnumWindows
GetForegroundWindow
ShowWindow
UnregisterClassW
GetPropW
SetWindowPos
GetWindowThreadProcessId
SendMessageW
DestroyWindow
PostMessageW
GetActiveWindow
LoadStringA
LoadStringW
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
GetDlgItem
wsprintfW
MsgWaitForMultipleObjects
SetMenuContextHelpId
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
DeleteMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
CheckMenuItem
DestroyMenu
CreatePopupMenu
IsMenu
UpdateLayeredWindow
MapVirtualKeyA

gdi32

Arc
Ellipse
CreateEllipticRgnIndirect
BitBlt
EnumFontsW
DeleteObject
CreateRoundRectRgn
CreateBitmap
CreateCompatibleDC
DeleteDC
ExcludeClipRect
GetClipRgn
GetRgnBox
CreatePen
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
Pie
PtInRegion
RectInRegion
RestoreDC
RoundRect
SaveDC
ExtSelectClipRgn
SetRectRgn
SetROP2
SetTextColor
GetWorldTransform
SetWorldTransform
CreateDIBSection
ExtCreatePen
Polyline
GetCurrentObject
GetViewportOrgEx
CreatePatternBrush
CreateRectRgn
GetTextColor
CreateRectRgnIndirect
CombineRgn
SetViewportOrgEx
CreateCompatibleBitmap
StretchBlt
GetDCOrgEx
GetObjectW
SetBkMode
Rectangle
GetStockObject
GetClipBox
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
SelectObject

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptGenRandom
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegEnumValueW
RegOpenKeyW
OpenServiceW
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExW
RegEnumKeyExW
ControlService
DeleteService
RegCreateKeyExW
RegDeleteKeyW
OpenSCManagerW
CloseServiceHandle
RegQueryInfoKeyW
RegCloseKey
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptDeriveKey
CryptCreateHash
CryptDecrypt
CryptEncrypt
QueryServiceStatus
CryptAcquireContextW
CryptGetKeyParam
CryptDestroyKey
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
SHFileOperationW

ole32

CreateBindCtx
CLSIDFromProgID
CLSIDFromString
OleLockRunning
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoCreateGuid
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysStringLen
VariantClear
SysFreeString
GetErrorInfo
VariantInit
CreateErrorInfo
SetErrorInfo
VariantChangeType
SysAllocString

shlwapi

StrCmpW
StrRChrW
PathIsDirectoryW
StrToIntExW
PathRemoveFileSpecW
PathCanonicalizeW
PathFindFileNameW
PathRemoveExtensionW
PathFileExistsW

netapi32

Netbios
NetApiBufferFree
NetWkstaGetInfo

iphlpapi

GetAdaptersInfo
GetIpForwardTable

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetSetOptionW

imm32

ImmAssociateContext
ImmGetContext
ImmReleaseContext

winhttp

WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpAddRequestHeaders

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipAlloc
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree

msimg32

GradientFill
AlphaBlend

crypt32

CertGetCertificateContextProperty
CertFindCertificateInStore
CertOpenStore
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage

wldap32

ord73
ord216
ord14
ord46
ord219
ord208
ord301
ord147
ord133
ord79
ord142
ord145
ord41
ord167
ord127
ord27
ord117
ord26

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 876KB - Virtual size: 876KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56.0MB - Virtual size: 56.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2d9e8e24991c40d3a4c8dac0c1f0036

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

7b:25:cd:86:06:d0:ee:31:a7:8c:2d:40Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b1:ab:b3:3f:ae:ad:fa:40:55:e5:06:e1:60:07:cb:1d:dc:a7:18:fb:89:19:b9:de:a6:2c:0a:2b:1e:89:8c:6fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

netapi32

iphlpapi

version

wininet

imm32

winhttp

gdiplus

msimg32

crypt32

wldap32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 876KB - Virtual size: 876KB

.data Size: 54KB - Virtual size: 147KB

.gfids Size: 6KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 56.0MB - Virtual size: 56.0MB

.reloc Size: 176KB - Virtual size: 176KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

7b:25:cd:86:06:d0:ee:31:a7:8c:2d:40
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b1:ab:b3:3f:ae:ad:fa:40:55:e5:06:e1:60:07:cb:1d:dc:a7:18:fb:89:19:b9:de:a6:2c:0a:2b:1e:89:8c:6f
Signer

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 876KB - Virtual size: 876KB

.data
Size: 54KB - Virtual size: 147KB

.gfids
Size: 6KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 56.0MB - Virtual size: 56.0MB

.reloc
Size: 176KB - Virtual size: 176KB