2024-04-20_7549ddbdd2ae7496eb7dc45b534c0c1a_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-20_7549ddbdd2ae7496eb7dc45b534c0c1a_magniber
Size 2.4MB
Sample240420-a94ceaca46
SHA256 6153967fd1357db3cd48373a2fad9cec354d1a00c7e8d706a099306d072734f2
MD5 7549ddbdd2ae7496eb7dc45b534c0c1a
SHA1 f7cd4642c119c169a553ffb374968fd66a07ffa0
SHA512 ec8676548e15583a008f60bc1af304cf6bb6676da7dcf7a51b3467a92330cd19a76a4a54e448f0bc60c27e41efb1f6346ed768a5bad6fc4c4266b01161f7d0c7
SSDEEP 49152:pdbkzSYl+aFUUhf3LIE3VEa9MlIMW0svKnp0:pfoL33VEa9IIKu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-04-20_7549ddbdd2ae7496eb7dc45b534c0c1a_magniber

.exe 2.4MB

2024-04-20_7549ddbdd2ae7496eb7dc45b534c0c1a_magniber

IMPHASH 9e06a884a787798c5a0284c5a9621007
SHA256 6153967fd1357db3cd48373a2fad9cec354d1a00c7e8d706a099306d072734f2
MD5 7549ddbdd2ae7496eb7dc45b534c0c1a
SHA1 f7cd4642c119c169a553ffb374968fd66a07ffa0
SHA512 ec8676548e15583a008f60bc1af304cf6bb6676da7dcf7a51b3467a92330cd19a76a4a54e448f0bc60c27e41efb1f6346ed768a5bad6fc4c4266b01161f7d0c7
SSDEEP 49152:pdbkzSYl+aFUUhf3LIE3VEa9MlIMW0svKnp0:pfoL33VEa9IIKu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

a3:1f:83:bf:c4:54:38:60:a2:38:af:40:e8:46:db:ec:4a:d9:cc:38:05:aa:28:0e:f5:b8:ad:89:9a:4c:c7:55

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle Corporation,OU=VirtualBox,O=Oracle Corporation,L=Redwood City,ST=California,C=US

Chains

Sep 4, 2020

CN=Oracle Corporation,OU=VirtualBox,O=Oracle Corporation,L=Redwood City,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

79:b4:f9:85:6d:6c:42:2e:89:16:c1:68:bb:fd:d3:d0:76:19:aa:69

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Oracle Corporation,OU=Virtualbox,O=Oracle Corporation,L=Redwood Shores,ST=CA,C=US

Chains

Sep 4, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=Oracle Corporation,OU=Virtualbox,O=Oracle Corporation,L=Redwood Shores,ST=CA,C=US

Serial Number

05:30:8b:76:ac:2e:15:b2:97:20:fb:43:95:f6:5f:38

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 19, 2019 - Mar 23, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Oracle Corporation,OU=VirtualBox,O=Oracle Corporation,L=Redwood City,ST=California,C=US

Serial Number

06:4b:33:30:a9:7d:03:a0:b4:51:59:1d:a8:68:7f:72

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 18, 2019 - Mar 18, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

1211576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\772492\out\Release\360TsLiveUpd.pdb

ws2_32

gethostbyname inet_ntoa

kernel32

CreateToolhelp32Snapshot LocalFree LocalAlloc GetExitCodeThread GetSystemInfo GetModuleHandleA GetModuleHandleExW WideCharToMultiByte ResetEvent SetLastError GetCurrentThreadId InterlockedCompareExchange QueryDosDeviceW GetLogicalDriveStringsW ExpandEnvironmentStringsW GetExitCodeProcess TerminateProcess OpenProcess InterlockedDecrement GetShortPathNameW GetVersion GetPrivateProfileIntW WritePrivateProfileStringW HeapFree HeapAlloc GetProcessHeap GetTickCount lstrcmpiW GetComputerNameW GetBinaryTypeW WaitForMultipleObjects CreateEventW GetModuleFileNameW SetFileTime SystemTimeToFileTime GetSystemTime GetPrivateProfileStringW GetWindowsDirectoryW CreateProcessW GetFileAttributesExW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetOverlappedResult CreateThread ExpandEnvironmentStringsA FileTimeToSystemTime CompareFileTime GetSystemTimeAsFileTime CreateRemoteThread CopyFileW lstrcmpiA lstrlenA Module32NextW Module32FirstW MoveFileW CreateDirectoryW GetLocalTime FreeConsole ReleaseSemaphore GetTempPathW GlobalFree GetTimeZoneInformation OpenMutexW GetCommandLineW Process32FirstW CreateSemaphoreW WritePrivateProfileSectionW GetProcessTimes CreateMutexA FlushInstructionCache InterlockedIncrement GetCurrentProcessId WTSGetActiveConsoleSessionId GetSystemWindowsDirectoryW GetDiskFreeSpaceExW UnmapViewOfFile lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetLocaleInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidLocale EnumSystemLocalesA CreateMutexW GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount SetConsoleCtrlHandler GetStringTypeA ExitProcess FatalAppExitA HeapCreate GetModuleFileNameA GetStdHandle GetCurrentThread IsValidCodePage GetOEMCP GetACP GetStringTypeW LCMapStringW LCMapStringA GetStartupInfoW ExitThread RtlUnwind GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsAlloc HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW GetFullPathNameW Process32NextW GetFileSize CreateFileMappingW MapViewOfFileEx SetEndOfFile FlushFileBuffers SetFilePointer WriteFile ReadFile FreeResource InterlockedExchange LoadLibraryExW LoadLibraryW GetCurrentProcess GetSystemPowerStatus GlobalMemoryStatusEx HeapDestroy GlobalMemoryStatus Sleep ProcessIdToSessionId LoadLibraryA FreeLibrary GetSystemDirectoryW GetDriveTypeW CreateFileW DeviceIoControl DeleteFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW MoveFileExW TerminateThread ReadDirectoryChangesW MultiByteToWideChar FindFirstFileW FindNextFileW FindClose ResumeThread SetEvent WaitForSingleObject lstrlenW CloseHandle UnlockFile LockFile GetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetVersionExW GetModuleHandleW GetProcAddress GetLocaleInfoA HeapReAlloc HeapSize ReleaseMutex FileTimeToLocalFileTime IsProcessorFeaturePresent VirtualFree VirtualAlloc CreateFileA LocalFileTimeToFileTime SetFilePointerEx GetFileSizeEx TlsGetValue

user32

MonitorFromWindow MonitorFromPoint SetFocus SetActiveWindow SetForegroundWindow AttachThreadInput GetForegroundWindow GetSystemMetrics ExitWindowsEx IsWindowVisible GetWindowThreadProcessId EnumWindows UnregisterClassA AllowSetForegroundWindow keybd_event GetKeyboardState MonitorFromRect GetWindowRect SetWindowPos GetWindowLongW UpdateWindow InvalidateRect SetWindowRgn WaitForInputIdle LoadStringW PostMessageW IsWindow FindWindowW SendMessageW SendMessageTimeoutW RegisterWindowMessageW EnumDisplaySettingsW DefWindowProcW GetClassInfoW RegisterClassW CreateDialogParamW CharNextW PeekMessageW GetMessageW TranslateMessage DispatchMessageW IsDialogMessageW SetWindowLongW PostQuitMessage LoadImageW GetParent GetWindow LoadIconW GetClientRect MapWindowPoints KillTimer SetTimer DestroyWindow GetDesktopWindow WindowFromPoint GetActiveWindow MessageBoxW GetMonitorInfoW

gdi32

CreatePolygonRgn

advapi32

LookupPrivilegeValueW RegEnumKeyExA RegQueryInfoKeyW InitializeSecurityDescriptor SetSecurityDescriptorDacl CreateServiceW OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle ChangeServiceConfigW ControlService StartServiceW QueryServiceStatusEx QueryServiceStatus GetNamedSecurityInfoW SetEntriesInAclW SetNamedSecurityInfoW RegCreateKeyA RegEnumValueW RegNotifyChangeKeyValue ConvertSidToStringSidW LookupAccountSidW RegUnLoadKeyW RegLoadKeyW RegDeleteKeyW ConvertStringSidToSidW GetLengthSid SetTokenInformation CreateProcessAsUserW RegDeleteValueW AllocateAndInitializeSid EqualSid CryptImportKey RegCreateKeyW GetSidSubAuthority DuplicateTokenEx GetTokenInformation RegOpenKeyW OpenEventLogW ReadEventLogW CloseEventLog OpenProcessToken AdjustTokenPrivileges FreeSid CryptAcquireContextW CryptGetKeyParam CryptDecrypt CryptEncrypt CryptDestroyHash CryptDestroyKey CryptReleaseContext RegSetValueExW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ord680 ord165 ShellExecuteW CommandLineToArgvW SHParseDisplayName SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderPathW ShellExecuteExW SHBindToParent SHGetDataFromIDListW ExtractIconExW SHGetFileInfoW SHGetFolderPathW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree CoInitialize CoUninitialize CLSIDFromProgID CoCreateInstance

oleaut32

VariantInit GetErrorInfo VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString VarUI4FromStr VariantClear SysAllocString

shlwapi

StrCmpNIW PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW PathRemoveExtensionW AssocQueryStringW PathUnquoteSpacesW StrChrW StrCmpNW PathAddBackslashW StrStrIA SHSetValueA SHDeleteValueA StrCmpW PathStripPathW PathStripToRootW ord437 StrCpyW StrCatW SHGetValueA PathFindExtensionW StrCmpIW PathAppendW PathFileExistsW SHDeleteValueW StrToIntExW SHSetValueW SHGetValueW wnsprintfW StrStrIW PathCombineW SHDeleteKeyW

comctl32

InitCommonControlsEx

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpQueryInfoW InternetReadFile InternetGetConnectedState InternetCloseHandle InternetOpenUrlW InternetQueryOptionW DeleteUrlCacheEntryW InternetOpenW InternetSetOptionW

powrprof

GetPwrCapabilities

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

userenv

GetUserProfileDirectoryW DestroyEnvironmentBlock CreateEnvironmentBlock

crypt32

CryptProtectData CryptUnprotectData CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-20_7549ddbdd2ae7496eb7dc45b534c0c1a_magniber

PE Signature issue

PE Signature issue

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

wininet

powrprof

wintrust

wtsapi32

userenv

crypt32

generic