2024-04-22_78373b185e4b410b76531ba35d1e521c_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-22_78373b185e4b410b76531ba35d1e521c_magniber
Size 2.3MB
Sample240422-bstbjsdh2y
SHA256 3846a3f073e8dd0a8b54ad2c406795e75e6316a37565c5a7fa3b3be9ce5d8fcd
MD5 78373b185e4b410b76531ba35d1e521c
SHA1 8877348c888ef1ad1b4cd7bc8651977be8ae9335
SHA512 9a7cefe296e3b83863eb9e43ee7f83f60b5c642ca74df5fbf3141cb3293fbd3afcd96f8ad876a55c13991b4c41a71896cb32e65295bce46e7d1cde15777a58bd
SSDEEP 49152:KCtI+vNrL3ctRG8Lnh5pkjamjYNexTKNPd/PAbkzSYl+aFUUhf3LIE3VEalMlrMF:Ky1oL33VEallIgUCxx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-22_78373b185e4b410b76531ba35d1e521c_magniber

File Explorer

2024-04-22_78373b185e4b410b76531ba35d1e521c_magniber

.exe 2.3MB

2024-04-22_78373b185e4b410b76531ba35d1e521c_magniber

IMPHASH 9e06a884a787798c5a0284c5a9621007
SHA256 3846a3f073e8dd0a8b54ad2c406795e75e6316a37565c5a7fa3b3be9ce5d8fcd
MD5 78373b185e4b410b76531ba35d1e521c
SHA1 8877348c888ef1ad1b4cd7bc8651977be8ae9335
SHA512 9a7cefe296e3b83863eb9e43ee7f83f60b5c642ca74df5fbf3141cb3293fbd3afcd96f8ad876a55c13991b4c41a71896cb32e65295bce46e7d1cde15777a58bd
SSDEEP 49152:KCtI+vNrL3ctRG8Lnh5pkjamjYNexTKNPd/PAbkzSYl+aFUUhf3LIE3VEalMlrMF:Ky1oL33VEallIgUCxx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1211576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\772492\out\Release\360TsLiveUpd.pdb

ws2_32

gethostbyname inet_ntoa

kernel32

CreateToolhelp32Snapshot LocalFree LocalAlloc GetExitCodeThread GetSystemInfo GetModuleHandleA GetModuleHandleExW WideCharToMultiByte ResetEvent SetLastError GetCurrentThreadId InterlockedCompareExchange QueryDosDeviceW GetLogicalDriveStringsW ExpandEnvironmentStringsW GetExitCodeProcess TerminateProcess OpenProcess InterlockedDecrement GetShortPathNameW GetVersion GetPrivateProfileIntW WritePrivateProfileStringW HeapFree HeapAlloc GetProcessHeap GetTickCount lstrcmpiW GetComputerNameW GetBinaryTypeW WaitForMultipleObjects CreateEventW GetModuleFileNameW SetFileTime SystemTimeToFileTime GetSystemTime GetPrivateProfileStringW GetWindowsDirectoryW CreateProcessW GetFileAttributesExW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetOverlappedResult CreateThread ExpandEnvironmentStringsA FileTimeToSystemTime CompareFileTime GetSystemTimeAsFileTime CreateRemoteThread CopyFileW lstrcmpiA lstrlenA Module32NextW Module32FirstW MoveFileW CreateDirectoryW GetLocalTime FreeConsole ReleaseSemaphore GetTempPathW GlobalFree GetTimeZoneInformation OpenMutexW GetCommandLineW Process32FirstW CreateSemaphoreW WritePrivateProfileSectionW GetProcessTimes CreateMutexA FlushInstructionCache InterlockedIncrement GetCurrentProcessId WTSGetActiveConsoleSessionId GetSystemWindowsDirectoryW GetDiskFreeSpaceExW UnmapViewOfFile lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetLocaleInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidLocale EnumSystemLocalesA CreateMutexW GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount SetConsoleCtrlHandler GetStringTypeA ExitProcess FatalAppExitA HeapCreate GetModuleFileNameA GetStdHandle GetCurrentThread IsValidCodePage GetOEMCP GetACP GetStringTypeW LCMapStringW LCMapStringA GetStartupInfoW ExitThread RtlUnwind GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsAlloc HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW GetFullPathNameW Process32NextW GetFileSize CreateFileMappingW MapViewOfFileEx SetEndOfFile FlushFileBuffers SetFilePointer WriteFile ReadFile FreeResource InterlockedExchange LoadLibraryExW LoadLibraryW GetCurrentProcess GetSystemPowerStatus GlobalMemoryStatusEx HeapDestroy GlobalMemoryStatus Sleep ProcessIdToSessionId LoadLibraryA FreeLibrary GetSystemDirectoryW GetDriveTypeW CreateFileW DeviceIoControl DeleteFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW MoveFileExW TerminateThread ReadDirectoryChangesW MultiByteToWideChar FindFirstFileW FindNextFileW FindClose ResumeThread SetEvent WaitForSingleObject lstrlenW CloseHandle UnlockFile LockFile GetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetVersionExW GetModuleHandleW GetProcAddress GetLocaleInfoA HeapReAlloc HeapSize ReleaseMutex FileTimeToLocalFileTime IsProcessorFeaturePresent VirtualFree VirtualAlloc CreateFileA LocalFileTimeToFileTime SetFilePointerEx GetFileSizeEx TlsGetValue

user32

MonitorFromWindow MonitorFromPoint SetFocus SetActiveWindow SetForegroundWindow AttachThreadInput GetForegroundWindow GetSystemMetrics ExitWindowsEx IsWindowVisible GetWindowThreadProcessId EnumWindows UnregisterClassA AllowSetForegroundWindow keybd_event GetKeyboardState MonitorFromRect GetWindowRect SetWindowPos GetWindowLongW UpdateWindow InvalidateRect SetWindowRgn WaitForInputIdle LoadStringW PostMessageW IsWindow FindWindowW SendMessageW SendMessageTimeoutW RegisterWindowMessageW EnumDisplaySettingsW DefWindowProcW GetClassInfoW RegisterClassW CreateDialogParamW CharNextW PeekMessageW GetMessageW TranslateMessage DispatchMessageW IsDialogMessageW SetWindowLongW PostQuitMessage LoadImageW GetParent GetWindow LoadIconW GetClientRect MapWindowPoints KillTimer SetTimer DestroyWindow GetDesktopWindow WindowFromPoint GetActiveWindow MessageBoxW GetMonitorInfoW

gdi32

CreatePolygonRgn

advapi32

LookupPrivilegeValueW RegEnumKeyExA RegQueryInfoKeyW InitializeSecurityDescriptor SetSecurityDescriptorDacl CreateServiceW OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle ChangeServiceConfigW ControlService StartServiceW QueryServiceStatusEx QueryServiceStatus GetNamedSecurityInfoW SetEntriesInAclW SetNamedSecurityInfoW RegCreateKeyA RegEnumValueW RegNotifyChangeKeyValue ConvertSidToStringSidW LookupAccountSidW RegUnLoadKeyW RegLoadKeyW RegDeleteKeyW ConvertStringSidToSidW GetLengthSid SetTokenInformation CreateProcessAsUserW RegDeleteValueW AllocateAndInitializeSid EqualSid CryptImportKey RegCreateKeyW GetSidSubAuthority DuplicateTokenEx GetTokenInformation RegOpenKeyW OpenEventLogW ReadEventLogW CloseEventLog OpenProcessToken AdjustTokenPrivileges FreeSid CryptAcquireContextW CryptGetKeyParam CryptDecrypt CryptEncrypt CryptDestroyHash CryptDestroyKey CryptReleaseContext RegSetValueExW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ord680 ord165 ShellExecuteW CommandLineToArgvW SHParseDisplayName SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderPathW ShellExecuteExW SHBindToParent SHGetDataFromIDListW ExtractIconExW SHGetFileInfoW SHGetFolderPathW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree CoInitialize CoUninitialize CLSIDFromProgID CoCreateInstance

oleaut32

VariantInit GetErrorInfo VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString VarUI4FromStr VariantClear SysAllocString

shlwapi

StrCmpNIW PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW PathRemoveExtensionW AssocQueryStringW PathUnquoteSpacesW StrChrW StrCmpNW PathAddBackslashW StrStrIA SHSetValueA SHDeleteValueA StrCmpW PathStripPathW PathStripToRootW ord437 StrCpyW StrCatW SHGetValueA PathFindExtensionW StrCmpIW PathAppendW PathFileExistsW SHDeleteValueW StrToIntExW SHSetValueW SHGetValueW wnsprintfW StrStrIW PathCombineW SHDeleteKeyW

comctl32

InitCommonControlsEx

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpQueryInfoW InternetReadFile InternetGetConnectedState InternetCloseHandle InternetOpenUrlW InternetQueryOptionW DeleteUrlCacheEntryW InternetOpenW InternetSetOptionW

powrprof

GetPwrCapabilities

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

userenv

GetUserProfileDirectoryW DestroyEnvironmentBlock CreateEnvironmentBlock

crypt32

CryptProtectData CryptUnprotectData CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-22_78373b185e4b410b76531ba35d1e521c_magniber

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

wininet

powrprof

wintrust

wtsapi32

userenv

crypt32

generic