2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber
Size 6.0MB
Sample240412-kbftkaha38
SHA256 774a909d25058c8b4b68ffa67541aa8ab9f1187493dd62322500944ef0dfd1e2
MD5 5bbd11ebebfc1e386178f53c87f4fe8d
SHA1 c2ccda47d0e634474296847b6f1c640af3d96d8b
SHA512 2cd432fe0fc9e27a015b3ee4ecae7780e4c3d54dcab64e919df5c630166d5bccb7ba013954f63b8020ab1576d7d2476c9ba8740c43403e85b8d511e086bfe5f9
SSDEEP 98304:7AFDc/A7ZAh3ByTl7Geu5nPIT2ZJHVNtgPpjwk+vmpoI3JCTDsRIDPYLT7Ryjl:RBh3w7Gh5Prtkb+fIU6IQRyx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

File Explorer

2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber

.exe 6.0MB

2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber

IMPHASH 2325fc72672592929e7487239d386d3e
SHA256 774a909d25058c8b4b68ffa67541aa8ab9f1187493dd62322500944ef0dfd1e2
MD5 5bbd11ebebfc1e386178f53c87f4fe8d
SHA1 c2ccda47d0e634474296847b6f1c640af3d96d8b
SHA512 2cd432fe0fc9e27a015b3ee4ecae7780e4c3d54dcab64e919df5c630166d5bccb7ba013954f63b8020ab1576d7d2476c9ba8740c43403e85b8d511e086bfe5f9
SSDEEP 98304:7AFDc/A7ZAh3ByTl7Geu5nPIT2ZJHVNtgPpjwk+vmpoI3JCTDsRIDPYLT7Ryjl:RBh3w7Gh5Prtkb+fIU6IQRyx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects executables packed with Themida

Digest

b3:86:d2:83:e9:1b:f3:4a:a1:66:0a:79:d6:e5:01:25:f4:b4:42:3f:9c:aa:b8:76:a8:7a:40:22:3e:3e:d0:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Internet Testing Systems,O=Internet Testing Systems,POSTALCODE=21211,STREET=Suite 401+STREET=3000 Chestnut Ave,L=Baltimore,ST=Maryland,C=US

Chains

Aug 2, 2023

CN=Internet Testing Systems,O=Internet Testing Systems,POSTALCODE=21211,STREET=Suite 401+STREET=3000 Chestnut Ave,L=Baltimore,ST=Maryland,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=Internet Testing Systems,O=Internet Testing Systems,POSTALCODE=21211,STREET=Suite 401+STREET=3000 Chestnut Ave,L=Baltimore,ST=Maryland,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Internet Testing Systems,O=Internet Testing Systems,POSTALCODE=21211,STREET=Suite 401+STREET=3000 Chestnut Ave,L=Baltimore,ST=Maryland,C=US

Serial Number

f8:f0:31:28:52:d3:a7:0b:43:ed:aa:a5:df:39:c4:a5

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2020 - Aug 6, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

298930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ITS\Azure Agent 02\_work\256\s\Release\ITSEdgeBrowser.pdb

version

GetFileVersionInfoA GetFileVersionInfoW VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoSizeA

kernel32

GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW FindClose FindFirstFileA FindNextFileA MultiByteToWideChar WideCharToMultiByte DeleteFileA GetFileAttributesExA FileTimeToSystemTime FreeLibrary LoadLibraryA CreateDirectoryW CreateFileW DeleteFileW FindFirstFileW FindNextFileW RemoveDirectoryW WriteFile GetTempPathW GetTempPathA SetEvent CreateMutexA GetCurrentProcess CreateThread OpenProcess GetTickCount64 IsWow64Process GetModuleFileNameW GetModuleHandleA LoadResource LockResource SizeofResource LoadLibraryW OpenMutexA FindResourceA K32GetProcessImageFileNameA GlobalReAlloc CreateFileA GetCurrentThreadId GetFileAttributesW TerminateProcess CreateProcessW GetVersionExA LocalAlloc LocalFree lstrcmpA lstrcpyW GetLogicalDriveStringsA CreateToolhelp32Snapshot Process32First Process32Next GetCommandLineW GetTempFileNameW DecodePointer RaiseException HeapDestroy HeapReAlloc HeapFree InitializeCriticalSectionEx DeleteCriticalSection RegisterApplicationRestart GlobalMemoryStatusEx ReleaseMutex GetComputerNameW GetSystemTime SystemTimeToFileTime OutputDebugStringA LoadLibraryExW GetEnvironmentVariableW GetStringTypeW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW CreateEventW ResetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx CompareStringEx GetModuleFileNameA GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx GetDriveTypeA WaitForSingleObject GetCPInfo RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA ReadFile ExitProcess GetStdHandle EncodePointer GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW ReleaseSemaphore HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent GlobalFree GlobalAlloc SetStdHandle GlobalMemoryStatus GetProcessHeap GetFileSizeEx FlushFileBuffers GetConsoleOutputCP SetEndOfFile HeapSize WriteConsoleW

user32

SetWindowTextA EndPaint BeginPaint GetSystemMetrics EnableWindow GetKeyState EndDialog GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList SetWindowDisplayAffinity GetClientRect DialogBoxParamA CreateWindowExW RegisterClassExW PostQuitMessage LoadStringW RegisterRawInputDevices SystemParametersInfoA GetAncestor SetWinEventHook EnumDisplayMonitors IsDialogMessageA GetWindowThreadProcessId GetClassNameA FindWindowExA FindWindowA GetDesktopWindow SetWindowLongA GetWindowLongA MessageBoxA GetWindowTextA SetForegroundWindow GetForegroundWindow UpdateWindow TranslateAcceleratorA LoadAcceleratorsA SendInput GetAsyncKeyState BringWindowToTop IsIconic SetWindowPos ShowWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA DefWindowProcA AttachThreadInput PostMessageA RegisterSuspendResumeNotification SendMessageA DispatchMessageA TranslateMessage GetMessageA wsprintfW EmptyClipboard CloseClipboard OpenClipboard wsprintfA MessageBoxW SetWindowTextW GetWindow

advapi32

RegCreateKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW GetUserNameW EventRegister EventSetInformation EventWriteTransfer EventUnregister RegGetValueW GetUserNameA

shell32

SetCurrentProcessExplicitAppUserModelID SHChangeNotify ord680 ShellExecuteW ShellExecuteExA ShellExecuteExW SHGetPropertyStoreForWindow SHGetSpecialFolderPathW SHGetSpecialFolderPathA SHCreateItemFromParsingName ShellExecuteA

shlwapi

PathRemoveFileSpecW PathRemoveFileSpecA PathRemoveExtensionA PathFindFileNameA PathFindFileNameW PathRemoveExtensionW PathFileExistsW

ole32

CoTaskMemAlloc CoTaskMemFree OleInitialize OleUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantInit SysAllocString SysStringLen SysFreeString SysAllocStringLen LoadTypeLi

urlmon

URLDownloadToFileA CoInternetCreateZoneManager CreateUri

wininet

InternetQueryOptionA InternetGetConnectedState HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetReadFile InternetOpenUrlA InternetConnectA InternetCloseHandle InternetOpenA InternetCanonicalizeUrlA InternetSetOptionA

crypt32

CryptDecodeObject CertFindCertificateInStore CertGetNameStringA CryptQueryObject CertGetNameStringW CertFreeCertificateChain CryptMsgGetParam

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-12_5bbd11ebebfc1e386178f53c87f4fe8d_magniber

version

kernel32

user32

advapi32

shell32

shlwapi

ole32

oleaut32

urlmon

wininet

crypt32

wintrust

generic