2024-05-29_6a4baec653fee6467c38859c5cd7f115_floxif_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-29_6a4baec653fee6467c38859c5cd7f115_floxif_magniber_revil
Size 8.6MB
Sample240529-mk8baabf4t
SHA256 9002c3f59c805923189977dba88581f3d4ddf7d6db82b1b363ac73c68cd253b9
MD5 6a4baec653fee6467c38859c5cd7f115
SHA1 b0e19777214b2e2ab937e8a395b94a56d67359ad
SHA512 df273d8f925eef5ec0c55929de3e69cd72f2dc38de4cf2b5f9e71edb91410b2057e760a94288a200cf5a269e82b246abdb185feb7e7bf4c251d2689ce65dab9d
SSDEEP 196608:sXb0bQILlRM83sey46aORWzwWrqufezvs+Q:sG3y46awcwW2uGzU3
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-05-29_6a4baec653fee6467c38859c5cd7f115_floxif_magniber_revil

.exe 8.6MB

2024-05-29_6a4baec653fee6467c38859c5cd7f115_floxif_magniber_revil

IMPHASH 6cacad8cfe387b687ab72c45344e7cbb
SHA256 9002c3f59c805923189977dba88581f3d4ddf7d6db82b1b363ac73c68cd253b9
MD5 6a4baec653fee6467c38859c5cd7f115
SHA1 b0e19777214b2e2ab937e8a395b94a56d67359ad
SHA512 df273d8f925eef5ec0c55929de3e69cd72f2dc38de4cf2b5f9e71edb91410b2057e760a94288a200cf5a269e82b246abdb185feb7e7bf4c251d2689ce65dab9d
SSDEEP 196608:sXb0bQILlRM83sey46aORWzwWrqufezvs+Q:sG3y46awcwW2uGzU3
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

d7:98:b9:20:b7:13:91:31:d6:0f:e6:77:17:18:2b:36:19:0a:08:e1:84:63:49:bb:71:61:81:9f:00:80:52:c1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1027700229193,CN=YANDEX LLC,O=YANDEX LLC,STREET=Leo Tolstoy street\, 16,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 20, 2023

Subject

Serial Number

79:04:d3:2e:74:fc:47:2b:66:c0:8a:38

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 6, 2022 - May 6, 2024

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

2522448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\8e6c08a363b4e0d2\seederexe\bin\Release\seederexe.pdb

shlwapi

ord176 SHCopyKeyA SHDeleteKeyA PathFileExistsW

userenv

CreateEnvironmentBlock

secur32

LsaGetLogonSessionData LsaEnumerateLogonSessions

wtsapi32

WTSEnumerateProcessesA WTSFreeMemory WTSQuerySessionInformationW

netapi32

NetApiBufferFree NetWkstaGetInfo

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

CreateFileW SetFileTime ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber VirtualFree GetFileTime FindResourceA SizeofResource LoadResource LockResource GetShortPathNameW Process32Next Process32First CreateToolhelp32Snapshot GetUserDefaultLangID GetUserGeoID GetGeoInfoW IsWow64Process VerifyVersionInfoW LoadLibraryW VerSetConditionMask WTSGetActiveConsoleSessionId ProcessIdToSessionId GetSystemDirectoryA SetConsoleTextAttribute DuplicateHandle CloseHandle WaitForSingleObject GetLastError GetCurrentProcessId GetCurrentProcess OpenProcess GetProcessHeap HeapFree HeapAlloc LoadLibraryA GetProcAddress FreeLibrary GetCommandLineW FormatMessageW LocalFree ReadConsoleA GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteConsoleW SetStdHandle SetConsoleMode SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetConsoleCtrlHandler ReadConsoleW GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetACP ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread LoadLibraryExW RtlUnwind InterlockedPushEntrySList GetConsoleScreenBufferInfo SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection CreateDirectoryW DeleteFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetEndOfFile SetFilePointer Sleep CopyFileW MoveFileExW ExpandEnvironmentStringsW GetCurrentDirectoryW GetLongPathNameW GetTempPathW GetSystemDirectoryW WideCharToMultiByte GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW ReadFile WriteFile GetStdHandle TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW GetConsoleWindow GetEnvironmentVariableW GetSystemInfo GetVersionExA GetVersionExW GetComputerNameW SetEvent GetCurrentThreadId SetThreadPriority GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetTimeZoneInformation CreateEventW FlushFileBuffers ResetEvent ReleaseMutex CreateMutexW WaitForMultipleObjects MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency EncodePointer DecodePointer SetLastError SwitchToThread GetTickCount GetModuleHandleW GetCPInfo GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW InitializeCriticalSection GetModuleFileNameA GetFileSizeEx GetModuleFileNameW UnmapViewOfFile GetModuleHandleA QueueUserWorkItem FlushViewOfFile RaiseException GetLocalTime SetFilePointerEx CreateFileMappingA MapViewOfFile MoveFileW CreateFileMappingW FormatMessageA GetSystemTime SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA WaitForSingleObjectEx CreateFileA OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI InitializeSListHead

user32

GetWindowThreadProcessId CreatePopupMenu GetShellWindow LoadStringW MessageBoxW GetUserObjectInformationW FindWindowExA GetProcessWindowStation DestroyMenu

advapi32

CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource GetTokenInformation CryptAcquireContextA CryptReleaseContext CryptGenRandom RegCloseKey RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyA RegQueryValueExW RegSetValueExW AdjustTokenPrivileges AllocateAndInitializeSid GetSidSubAuthority GetSidSubAuthorityCount GetLengthSid CopySid LookupAccountNameW LookupPrivilegeValueA LookupPrivilegeValueW RegSetValueExA RegQueryValueExA ConvertSidToStringSidA LsaNtStatusToWinError CheckTokenMembership DuplicateTokenEx OpenProcessToken

shell32

ord16 ord155 SHGetFolderPathW CommandLineToArgvW ShellExecuteExW ord190

ole32

CoSetProxyBlanket CoCreateInstance CoTaskMemFree CoInitialize CoInitializeSecurity CoInitializeEx CoUninitialize CoCreateGuid

oleaut32

SysAllocString VariantClear VariantInit

dbghelp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo

ws2_32

getsockname getsockopt listen recv ioctlsocket connect WSAStartup WSACleanup htons recvfrom ntohs send sendto closesocket gethostbyname htonl inet_ntoa gethostbyaddr getservbyport setsockopt shutdown socket WSARecv WSARecvFrom bind getservbyname inet_addr ntohl getaddrinfo freeaddrinfo WSASend getpeername accept WSASetLastError WSAGetLastError WSASendTo WSAPoll

crypt32

CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertOpenStore CertEnumCertificatesInStore CertCloseStore CertFindCertificateInStore

Sharing

General

Malware Config

Signatures

File Explorer

2024-05-29_6a4baec653fee6467c38859c5cd7f115_floxif_magniber_revil

PE Signature issue

shlwapi

userenv

secur32

wtsapi32

netapi32

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

dbghelp

iphlpapi

ws2_32

crypt32

generic