2024-05-28_858d819e60d95271c60bb1a4093050fc_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-28_858d819e60d95271c60bb1a4093050fc_magniber_revil
Size

6.3MB
MD5

858d819e60d95271c60bb1a4093050fc
SHA1

95651f9e9f8c8e518e5424b5a7be851a58f23f0d
SHA256

f24b020f61106cebaf0a01e3e19415e2c42d1b89ed10d87d7a834dc2ef7b5d04
SHA512

5b1fa94a15ce321d83170a52fee9041858e6a72494f7e122f04bb076460e3b044ca202e336bac861ac7c32ebd3227e02a5a4039161578b442d1a06c61963b251
SSDEEP

98304:+M4cMyz5gCdpO75U5vRLgm2B/h2yo9DMbJcioxcKK2SewFiYCJc7vfmIwwex:Hfjz5ghU5O1h2yrwh

Score

1^/10

Malware Config

Signatures

Files

2024-05-28_858d819e60d95271c60bb1a4093050fc_magniber_revil
.exe windows:5 windows x86 arch:x86

1b9aca8346415cb96a5ad7d2d25e2253

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:00:1d:ee:07:3e:e4:b8:1a:ad:51:97
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

02/05/2024, 13:44

Not After

23/05/2027, 05:35

Subject

SERIALNUMBER=1157746703058,CN=101XP LABS LLC,O=101XP LABS LLC,STREET=ul Tvardovskogo\, 8 / str 1 et/pom/kom 6/I/22,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0f:62:a7:9c:95:f1:a1:d8:08:cb:9b:59:0a:90:94:20:3a:23:b1:49
Signer

Actual PE Digest

0f:62:a7:9c:95:f1:a1:d8:08:cb:9b:59:0a:90:94:20:3a:23:b1:49

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\a.timohovich\Projects\launcher101xp_setup\Release\launcher101xp_setup.pdb

Imports

winhttp

WinHttpCloseHandle
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse

ws2_32

getservbyname
htons
WSAGetLastError
setsockopt
ioctlsocket
sendto
recvfrom
accept
ntohs
connect
freeaddrinfo
getaddrinfo
recv
send
WSACleanup
__WSAFDIsSet
gethostname
ntohl
getsockopt
gethostbyname
htonl
select
WSASetLastError
WSAStartup
WSAIoctl
shutdown
listen
getpeername
bind
closesocket
getsockname
socket

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

user32

ReleaseDC
GetForegroundWindow
SendMessageW
CharUpperW
GetUserObjectInformationW
GetProcessWindowStation
SetActiveWindow
WindowFromPoint
SetForegroundWindow
MessageBoxA
GetSysColor
FillRect
SetRect
MessageBeep
PostThreadMessageA
SystemParametersInfoA
CopyIcon
CreateIconIndirect
DestroyIcon
LoadIconA
LoadCursorA
GetWindow
GetParent
SetWindowLongA
GetWindowLongA
MapWindowPoints
ClientToScreen
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect
SetWindowTextW
ValidateRgn
InvalidateRect
GetUpdateRgn
KillTimer
SetTimer
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
GetAsyncKeyState
GetKeyState
SetFocus
IsClipboardFormatAvailable
EmptyClipboard
GetClipboardData
SetClipboardData
ChangeClipboardChain
SetClipboardViewer
CloseClipboard
OpenClipboard
BringWindowToTop
IsIconic
GetDC
SetWindowLongW
GetSystemMetrics
SetWindowRgn
SetWindowPos
GetWindowLongW
LoadIconW
MessageBoxW
GetKeyboardLayout
RegisterWindowMessageW
TranslateMessage
DispatchMessageW
GetClipboardOwner
PeekMessageA
PeekMessageW
SendMessageA
PostMessageA
DefWindowProcA
DefWindowProcW
RegisterClassExA
RegisterClassExW
CreateWindowExA
CreateWindowExW
IsWindow
DestroyWindow
ShowWindow
OpenIcon

advapi32

LookupPrivilegeValueW
SetFileSecurityW
AdjustTokenPrivileges
RegCloseKey
ReportEventA
RegisterEventSourceA
DeregisterEventSource
OpenProcessToken
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegQueryValueExW
RegDeleteKeyW
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegOpenKeyW
GetUserNameW

gdi32

Pie
Arc
ExtCreatePen
Polygon
DPtoLP
MoveToEx
PolyPolygon
RectInRegion
LineTo
GetRgnBox
EqualRgn
SetPixel
ExtCreateRegion
CreateCompatibleDC
BitBlt
SelectPalette
SelectObject
RealizePalette
GetStockObject
CreateSolidBrush
Polyline
CreateDCA
CreateFontA
GetGlyphOutlineW
GetTextExtentPoint32W
GetCharacterPlacementW
CreatePen
SetTextColor
GetDIBits
GetTextMetricsA
TextOutW
StretchDIBits
OffsetRgn
CreatePalette
GetDCOrgEx
GetObjectA
SelectClipRgn
CreateRoundRectRgn
GdiFlush
LPtoDP
CreatePolygonRgn
CreateDIBSection
PlayEnhMetaFile
GetEnhMetaFileHeader
AddFontMemResourceEx
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateRectRgn
DeleteDC
DeleteObject
GetDeviceCaps
RestoreDC
SaveDC
SetBkMode
SetDIBitsToDevice
SetTextAlign
UpdateColors

wldap32

ord211
ord30
ord200
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord143
ord46
ord79
ord60
ord45
ord301

normaliz

IdnToAscii

kernel32

InterlockedFlushSList
GetModuleHandleExW
GetModuleFileNameA
LockFileEx
GetStringTypeW
GetLocaleInfoW
CompareStringW
GetCPInfo
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
GetExitCodeThread
GetProcessHeap
HeapFree
HeapAlloc
IsDebuggerPresent
InitializeSListHead
UnlockFileEx
UnhandledExceptionFilter
GetFullPathNameW
FindNextFileA
FindFirstFileA
GetSystemDirectoryA
ExpandEnvironmentStringsA
SleepEx
WaitForSingleObjectEx
GetTickCount64
InitializeCriticalSectionEx
SetFilePointer
SetEndOfFile
InterlockedPushEntrySList
GetVersionExW
GetProcessAffinityMask
CreateEventW
MoveFileW
SetFileAttributesW
VirtualFree
VirtualAlloc
FlushConsoleInputBuffer
GlobalMemoryStatus
GetTickCount
OutputDebugStringA
GetStdHandle
GetStartupInfoW
GetExitCodeProcess
LCMapStringW
UnregisterWaitEx
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetFileAttributesExW
SetFilePointerEx
SetStdHandle
GetConsoleCP
ExitThread
GetFileSize
RtlUnwind
FreeLibraryAndExitThread
QueryPerformanceCounter
ReadConsoleInputA
HeapReAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
OutputDebugStringW
GetTimeZoneInformation
SetEnvironmentVariableA
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
VerSetConditionMask
GetSystemInfo
QueryPerformanceFrequency
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetThreadAffinityMask
GetThreadTimes
VirtualProtect
FileTimeToSystemTime
InterlockedPopEntrySList
QueryDepthSList
SetEnvironmentVariableW
VerifyVersionInfoA
GetFileType
IsProcessorFeaturePresent
FindClose
WriteConsoleW
ReadConsoleW
GetConsoleMode
SetConsoleMode
Sleep
SetConsoleCtrlHandler
SwitchToThread
DuplicateHandle
PeekNamedPipe
TlsFree
TlsGetValue
DeleteCriticalSection
GetEnvironmentVariableA
GetFileAttributesA
GetSystemTimeAsFileTime
GetCurrentProcess
CreateFileW
GetCurrentThreadId
GetLastError
CloseHandle
RaiseException
GetCurrentProcessId
SetUnhandledExceptionFilter
GetCurrentThread
VirtualQuery
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateProcessW
CreateDirectoryW
GetLogicalDrives
FindFirstFileW
GetDiskFreeSpaceW
InterlockedDecrement
GetModuleFileNameW
GetTempPathW
LoadLibraryW
MultiByteToWideChar
FormatMessageW
GetCurrentDirectoryW
GetProcAddress
LocalFree
GetModuleHandleW
CopyFileW
SizeofResource
LockResource
LoadResource
FindResourceW
ReleaseSemaphore
CreateSemaphoreW
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitOnceExecuteOnce
WideCharToMultiByte
DeleteFileW
FindNextFileW
RemoveDirectoryW
FreeLibrary
LoadLibraryExW
Module32FirstW
Module32NextW
LoadLibraryA
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
WaitForSingleObject
CreateThread
GetModuleHandleA
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoA
GetACP
GetComputerNameA
ExitProcess
lstrlenA
ReadFile
SetLastError
WriteFile
DeviceIoControl
SetFileTime
CreateHardLinkW
GetFileAttributesW
GetFileInformationByHandle
MoveFileExW
FlushFileBuffers
FormatMessageA
CreateIoCompletionPort
RegisterWaitForSingleObject
UnregisterWait
PostQueuedCompletionStatus
CreateEventA
SetErrorMode
TryEnterCriticalSection
TlsSetValue
WaitForMultipleObjects
ResumeThread
SetEvent
TlsAlloc
ResetEvent

shell32

SHGetMalloc
DragQueryFileW
ShellExecuteA
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFolderPathW
ShellExecuteExW

ole32

ReleaseStgMedium
DoDragDrop
RegisterDragDrop
OleUninitialize
CoCreateInstance
CoUninitialize
CoInitialize
OleInitialize

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantCopy
SysAllocStringLen
SysStringLen

dbghelp

SymFromAddr
SymSetOptions
StackWalk64
SymInitialize
SymFunctionTableAccess64
SymGetLineFromAddr64
SymGetModuleBase64
MiniDumpWriteDump

comctl32

_TrackMouseEvent

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 106KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 737KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b9aca8346415cb96a5ad7d2d25e2253

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

32:00:1d:ee:07:3e:e4:b8:1a:ad:51:97Certificate

Extended Key Usages

Key Usages

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

0f:62:a7:9c:95:f1:a1:d8:08:cb:9b:59:0a:90:94:20:3a:23:b1:49Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winhttp

ws2_32

rpcrt4

user32

advapi32

gdi32

wldap32

normaliz

kernel32

shell32

ole32

oleaut32

dbghelp

comctl32

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 2.2MB - Virtual size: 2.2MB

.data Size: 106KB - Virtual size: 154KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 737KB - Virtual size: 736KB

.reloc Size: 149KB - Virtual size: 148KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

32:00:1d:ee:07:3e:e4:b8:1a:ad:51:97
Certificate

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

0f:62:a7:9c:95:f1:a1:d8:08:cb:9b:59:0a:90:94:20:3a:23:b1:49
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 106KB - Virtual size: 154KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 737KB - Virtual size: 736KB

.reloc
Size: 149KB - Virtual size: 148KB