2024-04-20_af3e4155b9dfa9a6725cf2e981d31620_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-20_af3e4155b9dfa9a6725cf2e981d31620_magniber
Size 2.4MB
Sample240420-vy5rbaea8s
SHA256 2f32d76be245260576ccc0a87f38495632565d72cd4313771fb69206cd736556
MD5 af3e4155b9dfa9a6725cf2e981d31620
SHA1 715623ee73fc1cf49dbf1850f4a5d6e17851ca86
SHA512 19a32b9709825bcdb39f3f96a86454dc11db1ac87af40f25ef8ac6652ae3ec1f0b93304a88af6598b3f8649f73df9ededa99d079151129d108ace9596852f20f
SSDEEP 49152:fgTMbkzSYl+aFUUhf3LIE3VEalMkGBk7awcZFgFdsVHop0:fmqoL33VEaleBZy+R
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-04-20_af3e4155b9dfa9a6725cf2e981d31620_magniber

.exe 2.4MB

2024-04-20_af3e4155b9dfa9a6725cf2e981d31620_magniber

IMPHASH 511eb6a6b1b0231c116191c20c0c706d
SHA256 2f32d76be245260576ccc0a87f38495632565d72cd4313771fb69206cd736556
MD5 af3e4155b9dfa9a6725cf2e981d31620
SHA1 715623ee73fc1cf49dbf1850f4a5d6e17851ca86
SHA512 19a32b9709825bcdb39f3f96a86454dc11db1ac87af40f25ef8ac6652ae3ec1f0b93304a88af6598b3f8649f73df9ededa99d079151129d108ace9596852f20f
SSDEEP 49152:fgTMbkzSYl+aFUUhf3LIE3VEalMkGBk7awcZFgFdsVHop0:fmqoL33VEaleBZy+R
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

7d:6f:5d:87:d6:b9:b4:43:86:37:a3:fa:a4:89:21:99:b3:39:ca:20:6a:b1:67:74:fa:ca:bb:4e:4a:16:74:3a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle Corporation,OU=VirtualBox,O=Oracle Corporation,L=Redwood City,ST=California,C=US

Chains

Sep 4, 2020

CN=Oracle Corporation,OU=VirtualBox,O=Oracle Corporation,L=Redwood City,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

8c:cc:79:ee:f1:c6:b9:8e:76:2a:21:72:9e:37:6e:84:73:23:20:a4

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Oracle Corporation,OU=Virtualbox,O=Oracle Corporation,L=Redwood Shores,ST=CA,C=US

Chains

Sep 4, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=Oracle Corporation,OU=Virtualbox,O=Oracle Corporation,L=Redwood Shores,ST=CA,C=US

Serial Number

05:30:8b:76:ac:2e:15:b2:97:20:fb:43:95:f6:5f:38

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 19, 2019 - Mar 23, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Oracle Corporation,OU=VirtualBox,O=Oracle Corporation,L=Redwood City,ST=California,C=US

Serial Number

06:4b:33:30:a9:7d:03:a0:b4:51:59:1d:a8:68:7f:72

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 18, 2019 - Mar 18, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

1211576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\772492\out\Release\360TsLiveUpd.pdb

kernel32

CreateToolhelp32Snapshot LocalFree LocalAlloc GetExitCodeThread GetSystemInfo GetModuleHandleA GetModuleHandleExW WideCharToMultiByte ResetEvent SetLastError GetCurrentThreadId InterlockedCompareExchange QueryDosDeviceW GetLogicalDriveStringsW ExpandEnvironmentStringsW GetExitCodeProcess TerminateProcess OpenProcess InterlockedDecrement GetShortPathNameW GetVersion GetPrivateProfileIntW WritePrivateProfileStringW HeapFree HeapAlloc GetProcessHeap GetTickCount lstrcmpiW GetComputerNameW GetBinaryTypeW WaitForMultipleObjects CreateEventW GetModuleFileNameW SetFileTime SystemTimeToFileTime GetSystemTime GetPrivateProfileStringW GetWindowsDirectoryW CreateProcessW GetFileAttributesExW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetOverlappedResult CreateThread ExpandEnvironmentStringsA FileTimeToSystemTime CompareFileTime GetSystemTimeAsFileTime CreateRemoteThread CopyFileW lstrcmpiA lstrlenA Module32NextW Module32FirstW MoveFileW CreateDirectoryW GetLocalTime FreeConsole ReleaseSemaphore GetTempPathW GlobalFree GetTimeZoneInformation OpenMutexW GetCommandLineW Process32FirstW CreateSemaphoreW WritePrivateProfileSectionW GetProcessTimes CreateMutexA FlushInstructionCache InterlockedIncrement GetCurrentProcessId WTSGetActiveConsoleSessionId GetSystemWindowsDirectoryW GetDiskFreeSpaceExW UnmapViewOfFile lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetLocaleInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidLocale EnumSystemLocalesA CreateMutexW GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount SetConsoleCtrlHandler GetStringTypeA ExitProcess FatalAppExitA HeapCreate GetModuleFileNameA GetStdHandle GetCurrentThread IsValidCodePage GetOEMCP GetACP GetStringTypeW LCMapStringW LCMapStringA GetStartupInfoW ExitThread RtlUnwind GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsAlloc HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW GetFullPathNameW Process32NextW GetFileSize CreateFileMappingW MapViewOfFileEx SetEndOfFile FlushFileBuffers SetFilePointer WriteFile ReadFile FreeResource InterlockedExchange LoadLibraryExW LoadLibraryW GetCurrentProcess GetSystemPowerStatus GlobalMemoryStatusEx HeapDestroy GlobalMemoryStatus Sleep ProcessIdToSessionId LoadLibraryA FreeLibrary GetSystemDirectoryW GetDriveTypeW CreateFileW DeviceIoControl DeleteFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW MoveFileExW TerminateThread ReadDirectoryChangesW MultiByteToWideChar FindFirstFileW FindNextFileW FindClose ResumeThread SetEvent WaitForSingleObject lstrlenW CloseHandle UnlockFile LockFile GetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetVersionExW GetModuleHandleW GetProcAddress GetLocaleInfoA HeapReAlloc HeapSize ReleaseMutex FileTimeToLocalFileTime IsProcessorFeaturePresent VirtualFree VirtualAlloc CreateFileA LocalFileTimeToFileTime SetFilePointerEx GetFileSizeEx TlsGetValue

user32

MonitorFromWindow MonitorFromPoint SetFocus SetActiveWindow SetForegroundWindow AttachThreadInput GetForegroundWindow GetSystemMetrics ExitWindowsEx IsWindowVisible GetWindowThreadProcessId EnumWindows UnregisterClassA AllowSetForegroundWindow keybd_event GetKeyboardState MonitorFromRect GetWindowRect SetWindowPos GetWindowLongW UpdateWindow InvalidateRect SetWindowRgn WaitForInputIdle LoadStringW PostMessageW IsWindow FindWindowW SendMessageW SendMessageTimeoutW RegisterWindowMessageW EnumDisplaySettingsW DefWindowProcW GetClassInfoW RegisterClassW CreateDialogParamW CharNextW PeekMessageW GetMessageW TranslateMessage DispatchMessageW IsDialogMessageW SetWindowLongW PostQuitMessage LoadImageW GetParent GetWindow LoadIconW GetClientRect MapWindowPoints KillTimer SetTimer DestroyWindow GetDesktopWindow WindowFromPoint GetActiveWindow MessageBoxW GetMonitorInfoW

gdi32

CreatePolygonRgn

shell32

ord680 ord165 ShellExecuteW CommandLineToArgvW SHParseDisplayName SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderPathW ShellExecuteExW SHBindToParent SHGetDataFromIDListW ExtractIconExW SHGetFileInfoW SHGetFolderPathW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree CoInitialize CoUninitialize CLSIDFromProgID CoCreateInstance

oleaut32

VariantInit GetErrorInfo VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString VarUI4FromStr VariantClear SysAllocString

shlwapi

StrCmpNIW PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW PathRemoveExtensionW AssocQueryStringW PathUnquoteSpacesW StrChrW StrCmpNW PathAddBackslashW StrStrIA SHSetValueA SHDeleteValueA StrCmpW PathStripPathW PathStripToRootW ord437 StrCpyW StrCatW SHGetValueA PathFindExtensionW StrCmpIW PathAppendW PathFileExistsW SHDeleteValueW StrToIntExW SHSetValueW SHGetValueW wnsprintfW StrStrIW PathCombineW SHDeleteKeyW

comctl32

InitCommonControlsEx

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpQueryInfoW InternetReadFile InternetGetConnectedState InternetCloseHandle InternetOpenUrlW InternetQueryOptionW DeleteUrlCacheEntryW InternetOpenW InternetSetOptionW

powrprof

GetPwrCapabilities

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

userenv

GetUserProfileDirectoryW DestroyEnvironmentBlock CreateEnvironmentBlock

crypt32

CryptProtectData CryptUnprotectData CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-20_af3e4155b9dfa9a6725cf2e981d31620_magniber

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

wininet

powrprof

wintrust

wtsapi32

userenv

crypt32

generic