2024-06-25_7ad529e2458f3a26dc76818e96740117_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-25_7ad529e2458f3a26dc76818e96740117_magniber_revil
Size

13.4MB
MD5

7ad529e2458f3a26dc76818e96740117
SHA1

e6bb4592b09438123a79594382403c071d4481b4
SHA256

48f8ed964520ce2d713198e80d7291d6baed5b7493670a45711818136c462b64
SHA512

9a6ea5e970cad14af73140f011c59066f46b6f12e4587f9ca93f8e9d5346cbdfd1b9996b38cf40b4040be9d4c511314a7546283c7731988ad21d077b0bbd0c10
SSDEEP

393216:pMeL9Hh5ETpYWV/s5BuxsRSggL/t3ofR6GdtnFnv:pMeL1h5eY70d392/v

Score

1^/10

Malware Config

Signatures

Files

2024-06-25_7ad529e2458f3a26dc76818e96740117_magniber_revil
.exe windows:5 windows x86 arch:x86

06d0e177d00ed8ca825024a99c8ecdce

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

18:39:af:85:74:aa:0e:80:c3:71:d9:80:34:61:dd:7b
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

13/01/2022, 00:00

Not After

12/01/2025, 23:59

Subject

CN=ADLICE,O=ADLICE,ST=Loire-Atlantique,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

97:eb:ca:8c:68:50:8c:b3:09:92:25:19:6a:01:b1:2b:ac:76:e5:f6
Signer

Actual PE Digest

97:eb:ca:8c:68:50:8c:b3:09:92:25:19:6a:01:b1:2b:ac:76:e5:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Adlice\RogueKillerCMD\RelWithDebInfo\roguekillercmd.pdb

Imports

kernel32

lstrlenW
GetDriveTypeW
GetDiskFreeSpaceW
QueryDosDeviceW
GetVolumeInformationW
IsBadReadPtr
IsBadWritePtr
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
lstrcmpA
lstrcpyW
RaiseException
CreateThread
OpenThread
WriteProcessMemory
CreateRemoteThread
Module32FirstW
Module32NextW
InterlockedDecrement
DefineDosDeviceW
SetErrorMode
GetSystemInfo
GetSystemTimes
FormatMessageW
SetHandleInformation
PeekNamedPipe
CreateNamedPipeW
CancelIo
GetModuleFileNameA
GetEnvironmentVariableW
OutputDebugStringA
GetVersionExA
SetFilePointer
GlobalAlloc
GlobalFree
LoadLibraryExW
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
ReadConsoleA
ReadConsoleW
FormatMessageA
InitializeCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
CreateFileMappingA
lstrcmpiW
VirtualQuery
SetFilePointerEx
FlushFileBuffers
ReadFile
GetFileType
LocalAlloc
DeviceIoControl
GetTickCount
GetVersionExW
VerSetConditionMask
SetThreadUILanguage
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
CreateMutexW
UnlockFileEx
LockFile
AreFileApisANSI
VirtualQueryEx
CreateFileA
HeapCreate
GetFileSize
GetPrivateProfileStringW
HeapDestroy
InterlockedIncrement
FindResourceW
SizeofResource
LoadResource
LockResource
GetFileSizeEx
OutputDebugStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
SetThreadLocale
GetThreadLocale
GetUserGeoID
GetGeoInfoW
GetLocaleInfoW
GetModuleFileNameW
Sleep
LoadLibraryW
FreeLibrary
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetComputerNameW
GetTempFileNameW
GetTempPathW
GetSystemDirectoryW
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CreateEventW
WaitForMultipleObjects
ResetEvent
SetEvent
GetProcessHeap
HeapFree
HeapAlloc
Thread32Next
Thread32First
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateJobObject
AssignProcessToJobObject
CreateJobObjectW
CreateProcessW
GetModuleHandleA
WaitForSingleObject
ReadProcessMemory
SetLastError
TerminateThread
GetProcessId
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcess
GetProcessTimes
GetDateFormatW
GetTimeFormatW
CompareFileTime
FileTimeToSystemTime
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
CreateConsoleScreenBuffer
WriteConsoleW
SetConsoleWindowInfo
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleScreenBufferSize
SetConsoleActiveScreenBuffer
SetConsoleMode
GetConsoleCursorInfo
GetNumberOfConsoleInputEvents
GetConsoleMode
FillConsoleOutputCharacterW
WriteConsoleOutputW
ReadConsoleOutputW
ReadConsoleInputW
WriteFile
MoveFileExW
MoveFileW
CopyFileW
FindNextFileW
FindFirstFileW
GetFileAttributesExW
GetFileAttributesW
SetFileAttributesW
GetLastError
RemoveDirectoryW
CreateDirectoryW
GetFileTime
DeleteFileW
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
HeapSize
SetEndOfFile
GetFullPathNameA
SetStdHandle
CreateProcessA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
GetACP
GetCommandLineA
HeapReAlloc
FreeLibraryAndExitThread
ExitThread
ExitProcess
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
LCMapStringW
CompareStringW
GetCPInfo
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
GetModuleHandleW
BackupSeek
BackupRead
FindClose
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetFullPathNameW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
GetLongPathNameW
GetShortPathNameW
GetCommandLineW
LocalFree
SetConsoleCtrlHandler
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
CloseHandle
SwitchToThread

user32

FindWindowA
SendMessageA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
SystemParametersInfoW
GetSystemMetrics
CharNextW
LoadStringW
GetClassNameW
EnumChildWindows
GetWindowTextW
IsWindowVisible
SendMessageW
GetWindowThreadProcessId
EnumWindows

shell32

SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ord51
ShellExecuteExW

ole32

StringFromCLSID
CoTaskMemRealloc
CoTaskMemAlloc
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

VariantClear
VarUI4FromStr
SysStringLen
VariantInit
SysAllocString
SysFreeString

advapi32

CryptSignHashW
GetSecurityInfo
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateProcessAsUserW
DuplicateTokenEx
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
CryptGenRandom
CryptEnumProvidersW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
LookupAccountNameW
CopySid
GetLengthSid
ConvertStringSidToSidW
ConvertSidToStringSidW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetExplicitEntriesFromAclW
RegSetKeySecurity
RegGetKeySecurity
LookupAccountSidW
GetAce
IsValidSid
SetEntriesInAclW
CheckTokenMembership
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
FreeSid
AllocateAndInitializeSid
GetTokenInformation
StartServiceW
SetServiceObjectSecurity
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfig2W
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusW
EnumDependentServicesW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegQueryValueExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetUserNameW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

PathGetDriveNumberW
PathGetArgsW
PathSearchAndQualifyW
PathRemoveFileSpecW
PathUnquoteSpacesW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathCommonPrefixW
PathAppendW
PathAddBackslashW
PathRemoveExtensionW
PathRemoveBlanksW
PathRemoveBackslashW
StrCmpIW
StrDupW
AssocQueryStringW
StrFormatByteSizeW
PathRemoveArgsW
PathQuoteSpacesW
PathIsNetworkPathW
PathIsPrefixW
PathUnExpandEnvStringsW
PathIsRelativeW
PathIsDirectoryW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW
GetModuleBaseNameW
GetModuleInformation

ntdll

NtDeleteValueKey
NtSetValueKey
NtCreateKey
memmove
NtDeleteKey
memchr
isspace
memset
toupper
tolower
NtOpenKey
floor
memcpy
wcsstr
_wcsicmp
strcspn
memcmp
_CIpow
islower
isupper
wcstombs
strpbrk
strtol
strstr
atoi
_stricmp
_wtoi64
_strnicmp
NtQueryKey
isalnum
NtQueryVirtualMemory
strtoul
strspn
strncmp
strcmp
strrchr
strncpy
qsort
NtQuerySystemInformation
isdigit
strchr
wcsrchr
wcschr
RtlInitUnicodeString
NtLoadDriver
NtUnloadDriver
towupper
isprint

wininet

InternetGetConnectedState

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
GetProfilesDirectoryW

wintrust

CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext

mpr

WNetGetConnectionW

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken

wsock32

WSAStartup
WSACleanup
WSAGetLastError
recv
send
WSASetLastError
accept
bind
__WSAFDIsSet
connect
listen
setsockopt
socket
getpeername
sendto
recvfrom
gethostname
getsockopt
inet_ntoa
closesocket
htonl
select
htons
getsockname
ntohs
shutdown

ws2_32

getnameinfo
freeaddrinfo
getaddrinfo
WSAIoctl

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CryptQueryObject
CertGetNameStringW
CertNameToStrW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CryptDecodeObject

Sections

.text
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 129KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06d0e177d00ed8ca825024a99c8ecdce

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

18:39:af:85:74:aa:0e:80:c3:71:d9:80:34:61:dd:7bCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

97:eb:ca:8c:68:50:8c:b3:09:92:25:19:6a:01:b1:2b:ac:76:e5:f6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

oleaut32

advapi32

version

shlwapi

psapi

ntdll

wininet

userenv

wintrust

mpr

wtsapi32

wsock32

ws2_32

crypt32

Sections

.text Size: 5.7MB - Virtual size: 5.7MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 129KB - Virtual size: 218KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 6.1MB - Virtual size: 6.1MB

.reloc Size: 324KB - Virtual size: 323KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

18:39:af:85:74:aa:0e:80:c3:71:d9:80:34:61:dd:7b
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

97:eb:ca:8c:68:50:8c:b3:09:92:25:19:6a:01:b1:2b:ac:76:e5:f6
Signer

.text
Size: 5.7MB - Virtual size: 5.7MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 129KB - Virtual size: 218KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

.reloc
Size: 324KB - Virtual size: 323KB