meduza | 2024-08-17_2b240e8d2f0a4f2ba5d2c32257571e9d_floxif_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-08-17_2b240e8d2f0a4f2ba5d2c32257571e9d_floxif_magniber
Size

7.0MB
MD5

2b240e8d2f0a4f2ba5d2c32257571e9d
SHA1

7114b4de8e403acc543f03ce6666bcc54fa7d816
SHA256

fbf601e2fc89f81075e8a9b4738f0a4aa0a4f004152a0656ba56860333fcbf70
SHA512

3cef34b807334dbb05ee05e59fda23c0df5f4f41ef01b97b8b75494513f8e18df841a9981a5cfa5874a6cded0db36af5f85d5a8e249eaa642858e691d5e5fd7e
SSDEEP

98304:WKgU1fOYM/0xLYLApXRTwvmQwudqCYrMFkDvzLlau:GirEKRTfQoukDtau

Score

10^/10

meduza

Malware Config

Signatures

Meduza Stealer payload 1 IoCs

resource	yara_rule
sample	family_meduza

Meduza family
meduza

Files

2024-08-17_2b240e8d2f0a4f2ba5d2c32257571e9d_floxif_magniber
.exe windows:5 windows x86 arch:x86

256a980809e1717a4e69352a711493b9

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16-10-2020 00:00

Not After

24-10-2023 23:59

Subject

CN=RealVNC Ltd,O=RealVNC Ltd,L=Cambridge,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16-10-2020 00:00

Not After

24-10-2023 23:59

Subject

CN=RealVNC Ltd,O=RealVNC Ltd,L=Cambridge,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:5d:78:58:4c:59:95:13:1f:74:4c:50:a9:3f:e0:f6:bb:62:9d:6d:40:7b:99:77:27:10:ae:fd:08:7d:d3:f2
Signer

Actual PE Digest

04:5d:78:58:4c:59:95:13:1f:74:4c:50:a9:3f:e0:f6:bb:62:9d:6d:40:7b:99:77:27:10:ae:fd:08:7d:d3:f2

Digest Algorithm

sha256

PE Digest Matches

false

78:f7:dc:e9:b3:f6:f1:2a:c8:73:be:71:9c:01:57:32:3c:ac:91:5c
Signer

Actual PE Digest

78:f7:dc:e9:b3:f6:f1:2a:c8:73:be:71:9c:01:57:32:3c:ac:91:5c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jenkins-root\workspace\VNC_6.7.x\label\win-ent\bld32\RelWithDebInfo\vncviewer.pdb

Imports

crypt32

CryptUnprotectData
CryptProtectData
CryptAcquireCertificatePrivateKey
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertCloseStore
CertOpenStore

ws2_32

WSADuplicateSocketW
WSASocketW
htons
ntohs
WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
accept
bind
closesocket
ioctlsocket
getsockopt
setsockopt
socket
WSAStartup
WSAConnect
getpeername
getservbyname
getsockname
shutdown
send
recv
select
listen
WSASendTo
WSASend
WSASetLastError
htonl
getservbyport
gethostbyname
gethostbyaddr
ntohl
inet_ntoa
inet_addr
WSAGetLastError

comctl32

ImageList_ReplaceIcon
ImageList_Add
ImageList_Create
ImageList_Destroy
InitCommonControlsEx
_TrackMouseEvent

imm32

ImmGetVirtualKey
ImmGetContext
ImmSetOpenStatus

kernel32

SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
MoveFileW
LockResource
LoadResource
SizeofResource
FindResourceW
GetComputerNameW
LoadLibraryA
CompareStringW
GetSystemDirectoryW
GetVersionExW
GetTempPathW
GetTempFileNameW
CreateThread
GetCurrentThread
GetThreadTimes
TerminateThread
ResumeThread
OutputDebugStringW
RtlCaptureStackBackTrace
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetExitCodeProcess
LocalAlloc
GetSystemInfo
FlushFileBuffers
GetNumberFormatW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetTimeFormatW
GetDateFormatW
ExitProcess
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
CreateNamedPipeW
ConnectNamedPipe
WaitForMultipleObjects
GetUserDefaultLCID
GetLocaleInfoW
FindNextFileW
FindFirstFileW
OpenProcess
CreateProcessW
SetHandleInformation
DuplicateHandle
GetProcessId
SearchPathW
GetCurrentProcess
SetEndOfFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetProcAddress
GetCommandLineW
WriteConsoleW
ReadConsoleW
FreeConsole
AllocConsole
GetConsoleMode
SetStdHandle
GetFileType
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
LocalFree
CancelIo
GetOverlappedResult
WaitForSingleObject
Sleep
GetCurrentThreadId
ExpandEnvironmentStringsW
SetFileAttributesW
CreateFileW
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
CreateEventW
CloseHandle
ResetEvent
SetEvent
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetVolumeInformationW
FindFirstFileA
GetFileAttributesA
GetHandleInformation
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
FindClose
GetLogicalDrives
SetErrorMode
GetModuleFileNameW
LoadLibraryW
FreeLibrary
LeaveCriticalSection
ReadFile
WriteFile
GetStdHandle
GetLastError
GetCurrentProcessId
SetFilePointer
HeapSize
FormatMessageW
QueryPerformanceFrequency
LCMapStringW
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
LoadLibraryExW
SetFilePointerEx
GetConsoleCP
GetModuleFileNameA
GetACP
HeapAlloc
HeapFree
IsValidLocale
EnumSystemLocalesW
GetStringTypeW
DecodePointer
SetConsoleCtrlHandler
OutputDebugStringA
HeapReAlloc
SetEnvironmentVariableA
SetEnvironmentVariableW
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetSystemDirectoryA

user32

DefWindowProcW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
MsgWaitForMultipleObjects
DefDlgProcW
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
ChangeClipboardChain
SetClipboardViewer
SendMessageTimeoutW
CreateMenu
SetMenu
SetParent
ShowCursor
ScrollWindowEx
GetDoubleClickTime
IsWindowVisible
SetWindowRgn
IsZoomed
CloseClipboard
OpenClipboard
GetClipboardOwner
GetParent
CallNextHookEx
UnhookWindowsHookEx
GetForegroundWindow
MessageBoxW
IsDialogMessageW
EnumChildWindows
SetWindowTextW
EndDialog
DialogBoxParamW
CreateDialogParamW
SetMenuItemInfoW
PeekMessageW
DeleteMenu
GetMenuItemCount
CheckMenuItem
GetMenuState
GetKeyboardLayoutNameW
WindowFromPoint
IsWindowEnabled
PostMessageW
GetCursor
OffsetRect
GetWindowTextLengthW
GetWindowTextW
GetKeyState
GetClipboardData
LoadIconW
GetDesktopWindow
SetForegroundWindow
ReleaseCapture
SetCapture
GetDlgCtrlID
GetWindowPlacement
IsChild
GetMessageW
MapVirtualKeyW
keybd_event
VkKeyScanExW
VkKeyScanExA
ToAsciiEx
GetAsyncKeyState
GetKeyboardLayoutList
ToUnicodeEx
SendInput
mouse_event
SetWindowsHookExW
PostThreadMessageW
PostQuitMessage
GetSystemMetrics
GetCursorPos
SendMessageW
GetSystemMenu
EnableMenuItem
GetDlgItem
EnableWindow
ShowWindow
SetWindowPos
DrawTextW
BeginPaint
EndPaint
GetClientRect
GetClassNameW
GetWindowRect
TranslateMessage
DispatchMessageW
GetWindowLongW
CreateIconIndirect
RegisterWindowMessageW
RedrawWindow
KillTimer
InsertMenuItemW
SetTimer
GetComboBoxInfo
InflateRect
DrawFocusRect
DrawFrameControl
GetKeyboardState
GetKeyboardLayout
MapWindowPoints
SetCursor
MessageBeep
AdjustWindowRectEx
UpdateWindow
IsIconic
FrameRect
GetAncestor
GetNextDlgTabItem
SystemParametersInfoW
FillRect
ReleaseDC
GetWindowDC
GetDC
GetScrollInfo
SetScrollInfo
DrawIconEx
DestroyIcon
LoadCursorW
GetSysColorBrush
ScreenToClient
ClientToScreen
InvalidateRect
SetMenuDefaultItem
TrackPopupMenu
AppendMenuW
DestroyMenu
CreatePopupMenu
GetMessagePos
RegisterClipboardFormatW
GetSysColor
GetFocus
SetFocus
EmptyClipboard
SetClipboardData
GetWindowThreadProcessId
GetOpenClipboardWindow
SetWindowLongW

gdi32

StretchBlt
GetClipBox
CreateDCW
CreateCompatibleDC
CreateDIBSection
GdiAlphaBlend
SetPixelV
CreateBitmap
SetMapMode
GetTextExtentPoint32W
CreateFontIndirectW
GetTextMetricsW
CreateRectRgnIndirect
ExcludeClipRect
GetPixel
PatBlt
GetCharWidthW
SetBrushOrgEx
SetWindowOrgEx
SetStretchBltMode
SetRectRgn
SetPaletteEntries
SelectPalette
RealizePalette
OffsetRgn
GetRegionData
GetRandomRgn
CreateRectRgn
CreatePalette
CombineRgn
BitBlt
GetObjectW
RoundRect
CreateSolidBrush
CreateCompatibleBitmap
SetBkColor
Rectangle
GetStockObject
CreateBrushIndirect
MoveToEx
LineTo
DeleteObject
CreatePen
StretchDIBits
GetDeviceCaps
EndPage
StartPage
EndDoc
StartDocW
ResetDCW
DeleteDC
SetTextColor
SetBkMode
GetDIBits
SetDIBColorTable
SelectObject

shell32

SHGetFolderPathW
SHGetMalloc
SHAddToRecentDocs
SHFileOperationW
Shell_NotifyIconW
ord74
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetFileInfoW
SHGetDesktopFolder

ole32

CoTaskMemFree
OleGetClipboard
ReleaseStgMedium
OleSetClipboard
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
PropVariantClear
OleInitialize
RegisterDragDrop
DoDragDrop
CoTaskMemRealloc
CoInitializeSecurity
OleUninitialize
CoUninitialize
CoInitializeEx
CoSetProxyBlanket

oleaut32

SafeArrayGetDim
SysFreeString
SysAllocString
SafeArrayGetElement
VariantClear

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW

advapi32

DeregisterEventSource
CreateProcessAsUserW
OpenProcessToken
EqualSid
CryptReleaseContext
CryptSetProvParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegCloseKey
CryptGenRandom
CryptAcquireContextW
MakeAbsoluteSD
MakeSelfRelativeSD
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetSecurityDescriptorLength
InitializeSecurityDescriptor
SetEntriesInAclW
GetAclInformation
InitializeAcl
LookupAccountNameW
LookupAccountSidW
CopySid
GetLengthSid
GetSidIdentifierAuthority
FreeSid
AllocateAndInitializeSid
IsValidSid
CreateProcessWithLogonW
LogonUserW
GetTokenInformation
ReportEventW
RegisterEventSourceW
RegCreateKeyExW
GetUserNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityInfo
GetSecurityInfo
RegSetValueExW
RegQueryValueExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryInfoKeyW
CryptSignHashW

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 838KB - Virtual size: 838KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 274KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

256a980809e1717a4e69352a711493b9

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

04:5d:78:58:4c:59:95:13:1f:74:4c:50:a9:3f:e0:f6:bb:62:9d:6d:40:7b:99:77:27:10:ae:fd:08:7d:d3:f2Signer

78:f7:dc:e9:b3:f6:f1:2a:c8:73:be:71:9c:01:57:32:3c:ac:91:5cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

ws2_32

comctl32

imm32

kernel32

user32

gdi32

shell32

ole32

oleaut32

comdlg32

advapi32

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 70KB - Virtual size: 104KB

.rsrc Size: 838KB - Virtual size: 838KB

.reloc Size: 274KB - Virtual size: 274KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

06:0c:43:c8:90:48:4c:a5:e4:e0:35:62:6c:80:87:35
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

04:5d:78:58:4c:59:95:13:1f:74:4c:50:a9:3f:e0:f6:bb:62:9d:6d:40:7b:99:77:27:10:ae:fd:08:7d:d3:f2
Signer

78:f7:dc:e9:b3:f6:f1:2a:c8:73:be:71:9c:01:57:32:3c:ac:91:5c
Signer

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 70KB - Virtual size: 104KB

.rsrc
Size: 838KB - Virtual size: 838KB

.reloc
Size: 274KB - Virtual size: 274KB