meduza | 2024-06-14_e8360804a99ff55ae2919ef153ad05d4_avoslocker_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-14_e8360804a99ff55ae2919ef153ad05d4_avoslocker_magniber
Size

8.4MB
MD5

e8360804a99ff55ae2919ef153ad05d4
SHA1

061c50636585e62c76e951e902cc03ebdfadabd4
SHA256

bded3addc990fa93827a6cfbf9687076df89cead996396e443d4465c4de43aba
SHA512

2b4e53a2a7797f2a52c28908cf9141c80c75c54b25b6842b04994ecfae1e5aab92dd7c17b2a032cf6349c8e51705d845d9b5cc9269c344d0edb58bacfc97fdcb
SSDEEP

98304:mSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww7:1wJKZ/TaCgQdWNXx8A0PqPjNLa5

Score

10^/10

meduza

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Meduza Stealer payload 1 IoCs

resource	yara_rule
sample	family_meduza

Meduza family
meduza

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-14_e8360804a99ff55ae2919ef153ad05d4_avoslocker_magniber

Files

2024-06-14_e8360804a99ff55ae2919ef153ad05d4_avoslocker_magniber
.exe windows:6 windows x86 arch:x86

f4f6a7d5a6fec0b25f180f2be6176b0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ent-slave-root\workspace\VNCConnect\Builds\Clients\VNC_6.11.x\label\con-windows-64\bld32\RelWithDebInfo\vncviewer.pdb

Imports

crypt32

CertFreeCertificateContext
CertGetEnhancedKeyUsage
CryptUnprotectData
CryptProtectData
CryptAcquireCertificatePrivateKey
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertCloseStore
CertOpenStore

ws2_32

WSADuplicateSocketW
WSASocketW
htons
ntohs
WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
accept
bind
closesocket
ioctlsocket
getsockopt
setsockopt
socket
WSAStartup
WSAConnect
getpeername
getservbyname
getsockname
shutdown
send
recv
listen
select
WSASendTo
WSASend
WSASetLastError
htonl
getservbyport
gethostbyname
gethostbyaddr
ntohl
inet_ntoa
inet_addr
WSAGetLastError

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Add
ImageList_Create
_TrackMouseEvent
ImageList_Destroy

imm32

ImmGetVirtualKey
ImmGetContext
ImmSetOpenStatus

kernel32

LCMapStringW
FormatMessageW
GetHandleInformation
SetHandleInformation
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
GetFileAttributesW
RemoveDirectoryW
SetEndOfFile
SetFilePointer
MoveFileW
LoadResource
LockResource
SizeofResource
FindResourceW
GetLocaleInfoW
GetSystemDirectoryA
LoadLibraryA
GetSystemDirectoryW
GetVersionExW
GetTempPathW
GetTempFileNameW
CreateThread
GetCurrentThread
TerminateThread
ResumeThread
GetThreadTimes
OutputDebugStringW
RtlCaptureStackBackTrace
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetExitCodeProcess
GetProcessId
LocalAlloc
GetSystemInfo
FlushFileBuffers
WriteFile
GetNumberFormatW
ReOpenFile
DuplicateHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTimeFormatW
GetDateFormatW
ExitProcess
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
OpenProcess
CreateProcessW
QueryFullProcessImageNameW
GetCurrentProcess
SearchPathW
GetProcAddress
GetSystemTimeAsFileTime
GetCommandLineW
WriteConsoleW
WaitForMultipleObjects
GetConsoleMode
FreeConsole
AllocConsole
SetLastError
GetFileType
SetStdHandle
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
LocalFree
GetNativeSystemInfo
WakeAllConditionVariable
TryEnterCriticalSection
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
CreateSemaphoreW
SetThreadPriority
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseSemaphore
QueryPerformanceFrequency
QueryPerformanceCounter
CancelIo
GetOverlappedResult
ReadFile
WaitForSingleObject
GetCurrentThreadId
Sleep
SetFileAttributesW
CreateFileW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalSize
GetFileAttributesExW
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetErrorMode
CreateNamedPipeW
GetVolumeInformationW
GetLogicalDrives
GetFileAttributesA
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
FindFirstFileA
FindClose
GetLastError
LoadLibraryW
HeapSize
GetModuleFileNameW
FreeLibrary
GetCurrentProcessId
CloseHandle
CompareStringW
ConnectNamedPipe
ReadConsoleW
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
LoadLibraryExW
SetFilePointerEx
GetConsoleOutputCP
ExitThread
FreeLibraryAndExitThread
HeapAlloc
HeapFree
IsValidLocale
EnumSystemLocalesW
GetFileSizeEx
DecodePointer
SetConsoleCtrlHandler
HeapReAlloc
SetEnvironmentVariableW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
GetComputerNameW

user32

GetForegroundWindow
DefWindowProcW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
PeekMessageW
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
ChangeClipboardChain
SetClipboardViewer
SendMessageTimeoutW
CreateMenu
SetMenu
SetParent
ShowCursor
ScrollWindowEx
GetDoubleClickTime
IsWindowVisible
SetWindowRgn
IsZoomed
CloseClipboard
OpenClipboard
GetClipboardOwner
GetParent
CallNextHookEx
UnhookWindowsHookEx
MapVirtualKeyW
MessageBoxW
IsDialogMessageW
EnumChildWindows
SetWindowTextW
EndDialog
DialogBoxParamW
CreateDialogParamW
SetMenuItemInfoW
CreateIconIndirect
DeleteMenu
GetMenuItemCount
CheckMenuItem
GetMenuState
GetKeyboardLayoutNameW
WindowFromPoint
GetClassNameW
IsWindowEnabled
PostMessageW
GetCursor
OffsetRect
GetWindowTextLengthW
GetKeyState
GetClipboardData
LoadIconW
GetDesktopWindow
SetForegroundWindow
ReleaseCapture
SetCapture
GetDlgCtrlID
GetWindowPlacement
IsChild
GetMessageW
keybd_event
VkKeyScanExW
VkKeyScanExA
ToAsciiEx
GetAsyncKeyState
GetKeyboardLayoutList
ToUnicodeEx
SendInput
mouse_event
PostThreadMessageW
SetWindowsHookExW
MsgWaitForMultipleObjects
PostQuitMessage
GetSystemMetrics
GetCursorPos
SendMessageW
GetSystemMenu
EnableMenuItem
GetDlgItem
EnableWindow
ShowWindow
SetWindowPos
DrawTextW
BeginPaint
EndPaint
GetClientRect
GetWindowTextW
GetWindowRect
TranslateMessage
DispatchMessageW
GetWindowLongW
RegisterWindowMessageW
RedrawWindow
KillTimer
SetTimer
InsertMenuItemW
DefDlgProcW
GetComboBoxInfo
InflateRect
DrawFocusRect
DrawFrameControl
GetKeyboardState
GetKeyboardLayout
MapWindowPoints
SetCursor
MessageBeep
AdjustWindowRectEx
UpdateWindow
IsIconic
FrameRect
GetAncestor
GetNextDlgTabItem
SystemParametersInfoW
FillRect
ReleaseDC
GetWindowDC
GetDC
GetScrollInfo
SetScrollInfo
DrawIconEx
DestroyIcon
LoadCursorW
GetSysColorBrush
ScreenToClient
ClientToScreen
InvalidateRect
SetMenuDefaultItem
TrackPopupMenu
AppendMenuW
DestroyMenu
CreatePopupMenu
GetMessagePos
RegisterClipboardFormatW
GetSysColor
GetFocus
SetFocus
EmptyClipboard
SetClipboardData
GetWindowThreadProcessId
GetOpenClipboardWindow
SetWindowLongW

gdi32

StretchBlt
GetClipBox
CreateCompatibleDC
SetDIBColorTable
CreateDIBSection
GdiAlphaBlend
CreateBitmap
SetMapMode
GetTextExtentPoint32W
CreateFontIndirectW
GetTextMetricsW
CreateRectRgnIndirect
ExcludeClipRect
GetPixel
PatBlt
GetCharWidthW
SetBrushOrgEx
SetWindowOrgEx
SetStretchBltMode
SetRectRgn
SetPaletteEntries
SelectPalette
RealizePalette
OffsetRgn
GetRegionData
GetRandomRgn
CreateRectRgn
CreatePalette
CombineRgn
BitBlt
GetObjectW
RoundRect
CreateSolidBrush
CreateCompatibleBitmap
SetBkColor
Rectangle
GetStockObject
CreateBrushIndirect
MoveToEx
LineTo
DeleteObject
CreatePen
StretchDIBits
GetDeviceCaps
EndPage
StartPage
EndDoc
StartDocW
ResetDCW
DeleteDC
SetTextColor
SetBkMode
GetDIBits
CreateDCW
SelectObject

shell32

SHGetKnownFolderPath
SHGetMalloc
SHAddToRecentDocs
SHFileOperationW
Shell_NotifyIconW
ord74
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetFileInfoW
SHGetDesktopFolder

ole32

CoTaskMemFree
OleGetClipboard
ReleaseStgMedium
OleSetClipboard
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
PropVariantClear
OleInitialize
RegisterDragDrop
DoDragDrop
CoTaskMemRealloc
CoInitializeSecurity
OleUninitialize
CoUninitialize
CoInitializeEx
CoSetProxyBlanket

oleaut32

SafeArrayGetDim
SysFreeString
SysAllocString
SafeArrayGetElement
VariantClear

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

advapi32

GetTokenInformation
CryptCreateHash
CryptSetProvParam
CryptReleaseContext
CryptDestroyHash
CryptSignHashW
CreateProcessAsUserW
OpenProcessToken
EqualSid
RegCloseKey
CryptGenRandom
CryptAcquireContextW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
MakeSelfRelativeSD
MakeAbsoluteSD
InitializeSecurityDescriptor
GetSecurityDescriptorLength
GetSecurityDescriptorControl
SetEntriesInAclW
InitializeAcl
GetAclInformation
ConvertStringSidToSidW
ConvertSidToStringSidW
LookupAccountNameW
LookupAccountSidW
IsValidSid
GetSidIdentifierAuthority
GetLengthSid
FreeSid
CopySid
AllocateAndInitializeSid
CreateProcessWithLogonW
LogonUserW
CryptHashData
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetUserNameW
SetSecurityInfo
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegNotifyChangeKeyValue
RegOpenKeyExW
GetSecurityInfo
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4f6a7d5a6fec0b25f180f2be6176b0a

Headers

File Characteristics

PDB Paths

Imports

crypt32

ws2_32

comctl32

imm32

kernel32

user32

gdi32

shell32

ole32

oleaut32

comdlg32

advapi32

Sections

.text Size: 5.9MB - Virtual size: 5.9MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 74KB - Virtual size: 121KB

.rodata Size: 2KB - Virtual size: 2KB

.rsrc Size: 412KB - Virtual size: 411KB

.reloc Size: 316KB - Virtual size: 316KB

.text
Size: 5.9MB - Virtual size: 5.9MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 74KB - Virtual size: 121KB

.rodata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 412KB - Virtual size: 411KB

.reloc
Size: 316KB - Virtual size: 316KB