Overview

overview

9

Static

static

3

2024-04-05...er.exe

windows7-x64

7

2024-04-05...er.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-04-05_108b70d3705a00a5dd6d62b913620511_magniber

  • Size

    4.7MB

  • Sample

    240405-brxmksgb8x

  • MD5

    108b70d3705a00a5dd6d62b913620511

  • SHA1

    5362a8117d22a8f22f657bb920c99177c4b19648

  • SHA256

    4a8999f613d561c0a825067b089877c1e4e5e9c8498fdbcb5846d69a83b80109

  • SHA512

    bc1c453456f0b44e4419638d54770ad80518b5d5ddcf029c59a49c62149d7d009b3e408e79502d8e1b1a716cbea2e5fb32c0bb92691e387554cf37ad1e009a18

  • SSDEEP

    98304:Hbgwm93udfvBtp0v+jT/KFdGRv/SrbeJo7PRf0dFB8DjLr:7tm81pjW8Efbe27PRcK/

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-04-05_108b70d3705a00a5dd6d62b913620511_magniber

    • Size

      4.7MB

    • MD5

      108b70d3705a00a5dd6d62b913620511

    • SHA1

      5362a8117d22a8f22f657bb920c99177c4b19648

    • SHA256

      4a8999f613d561c0a825067b089877c1e4e5e9c8498fdbcb5846d69a83b80109

    • SHA512

      bc1c453456f0b44e4419638d54770ad80518b5d5ddcf029c59a49c62149d7d009b3e408e79502d8e1b1a716cbea2e5fb32c0bb92691e387554cf37ad1e009a18

    • SSDEEP

      98304:Hbgwm93udfvBtp0v+jT/KFdGRv/SrbeJo7PRf0dFB8DjLr:7tm81pjW8Efbe27PRcK/

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (5962) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks