Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_ed881137648ba369459571fbf400ff8b_magniber.exe
Resource
win7-20240221-en
General
-
Target
2024-03-19_ed881137648ba369459571fbf400ff8b_magniber
-
Size
4.5MB
-
MD5
ed881137648ba369459571fbf400ff8b
-
SHA1
7509635c069501a6f3d9560fd4d6d7a8d7eae23b
-
SHA256
6d3072df2462b10a3e116f80f3cf41bd423d2ecf4b280bada65bffba1451c8f3
-
SHA512
a7284b13bbc3664b56a3776bcb8ec677e89f29c6af19ccb7e404cc175692a7019335e854590dd08a0112885a90a8454d4aba310e635e79c06f2d5c56048c27d4
-
SSDEEP
98304:vYcLUh7H1AW9Zs6gu2+dAYStsjpRUVnDaa1vW:/6PxVK6jpRUVDaa1vW
Malware Config
Signatures
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-19_ed881137648ba369459571fbf400ff8b_magniber
Files
-
2024-03-19_ed881137648ba369459571fbf400ff8b_magniber.exe windows:5 windows x86 arch:x86
caa3f9f270820253708e0149c30fc3f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertCreateCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
winhttp
WinHttpGetIEProxyConfigForCurrentUser
iphlpapi
GetAdaptersInfo
kernel32
QueryDepthSList
UnregisterWaitEx
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
InterlockedCompareExchange
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
PostQueuedCompletionStatus
TlsAlloc
TlsFree
GetVersion
OpenProcess
FindClose
QueryDosDeviceW
FindFirstFileW
FindNextFileW
GetCurrentProcess
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
TlsGetValue
GetModuleHandleA
CancelIo
VerSetConditionMask
TerminateThread
SetLastError
GetQueuedCompletionStatus
QueueUserAPC
WaitForMultipleObjects
TlsSetValue
SetWaitableTimer
CopyFileW
GetComputerNameW
VerifyVersionInfoW
CreateToolhelp32Snapshot
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetProcessId
SetFileAttributesW
Process32FirstW
Process32NextW
ExitProcess
SetThreadExecutionState
SetProcessShutdownParameters
TerminateProcess
GetCurrentThread
DuplicateHandle
GetModuleHandleW
CreateProcessW
VerifyVersionInfoA
SleepEx
GetSystemDirectoryA
ExpandEnvironmentStringsA
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetStringTypeW
QueryPerformanceFrequency
GetExitCodeThread
GetNativeSystemInfo
EncodePointer
DecodePointer
QueueUserWorkItem
RtlCaptureStackBackTrace
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileTime
SetFilePointerEx
SetFileTime
DeviceIoControl
CreateDirectoryExW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetConsoleCtrlHandler
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameA
GetStdHandle
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
SetStdHandle
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualAlloc
VirtualFree
SetProcessAffinityMask
ReleaseSemaphore
InterlockedPopEntrySList
WaitForMultipleObjectsEx
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 333KB - Virtual size: 333KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 43KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ