2024-08-19_6fc1219c19995c570ba7976a69cdb75e_hijackloader_magniber_revil

Sharing

Copy URL

Twitter E-mail

General

Target

2024-08-19_6fc1219c19995c570ba7976a69cdb75e_hijackloader_magniber_revil
Size

19.8MB
MD5

6fc1219c19995c570ba7976a69cdb75e
SHA1

0610c3c7bac623bdcc831c470e80462e87bdadfd
SHA256

877b30ecc9eff9560e8d40ba57dbea524585b9c7ccdb75ecb221ecba53e6ef7c
SHA512

5481050847ed8416ea449c85e233d64bf9025e04c1b0013198352dfdafcc0db426ed6a6c8c108cc2f88d3eeb1ddd8f7f127393c7a6b2011618252d4454fa209e
SSDEEP

393216:Kesh2dssoUFHuRgRg1OkHWBHOUfeUJ+fKIdfcZcqO89YdEG3ldBHwRXd3/3F:/pHuP1Okgu6/J+fKIdfovBGdEGYN3/3F

Score

1^/10

Malware Config

Signatures

Files

2024-08-19_6fc1219c19995c570ba7976a69cdb75e_hijackloader_magniber_revil
.exe windows:5 windows x86 arch:x86

aeb60504157277657640c64c52d0c67b

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:5d:45:23:54:52:ea:9e:e9:0c:37:04:98:8e:02:8e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/04/2022, 00:00

Not After

02/05/2025, 23:59

Subject

SERIALNUMBER=91510100677184972A,CN=四川迅游网络科技股份有限公司,O=四川迅游网络科技股份有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:af:71:f8:0b:4a:04:21:b0:d2:e2:14:12:00:71:76:9e:29:13:99:b7:44:ac:7e:c8:e7:c1:2b:45:1e:b3:34
Signer

Actual PE Digest

77:af:71:f8:0b:4a:04:21:b0:d2:e2:14:12:00:71:76:9e:29:13:99:b7:44:ac:7e:c8:e7:c1:2b:45:1e:b3:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
GetCurrentDirectoryW
GetFileInformationByHandle
GetStdHandle
SetFileTime
SetFilePointer
SetEndOfFile
GetFileSize
CompareFileTime
GetModuleHandleA
LoadLibraryA
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
InterlockedCompareExchange
IsBadReadPtr
GetSystemTime
GetVersionExA
GetLocalTime
GetVersionExW
GetTickCount
MulDiv
GetFullPathNameW
EnumResourceNamesW
EnumResourceTypesW
FreeResource
GetCurrentThreadId
GetCurrentProcess
HeapCreate
FlushInstructionCache
InterlockedDecrement
InterlockedIncrement
FreeLibrary
LoadLibraryW
GetDiskFreeSpaceExW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
OpenProcess
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
FlushFileBuffers
SetConsoleCtrlHandler
GetACP
ExitProcess
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetFileAttributesExW
GetCommandLineW
GetCommandLineA
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
SystemTimeToFileTime
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
GetModuleHandleExW
SetConsoleMode
ReadConsoleW
ReadConsoleA
GetConsoleMode
GetEnvironmentVariableW
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetEnvironmentVariableA
WaitForSingleObject
MoveFileExA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
FormatMessageA
SwitchToThread
InitializeSListHead
GetStartupInfoW
GetVolumePathNameW
TerminateProcess
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetFilePointerEx
FileTimeToSystemTime
SetFileAttributesW
GetSystemDirectoryW
SetLastError
GetFileSizeEx
ReadFile
CreateDirectoryW
SetCurrentDirectoryW
CreateMutexW
GetModuleFileNameW
lstrcmpW
lstrcpyW
WideCharToMultiByte
GetModuleHandleW
GetCurrentProcessId
GetProcAddress
FindResourceW
LoadResource
CloseHandle
DeleteFileW
LockResource
lstrcatW
Sleep
MultiByteToWideChar
GetFileAttributesW
CreateFileW
FindClose
RemoveDirectoryW
OutputDebugStringA
WriteFile
FindNextFileW
FindFirstFileW
SizeofResource
GetProcessHeap
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
QueryPerformanceFrequency
QueryPerformanceCounter
EncodePointer
GetExitCodeThread
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
FormatMessageW
OutputDebugStringW
IsDebuggerPresent
InitializeCriticalSectionEx
GetUserDefaultLCID
HeapFree

user32

SetFocus
GetDlgCtrlID
GetUserObjectInformationW
GetProcessWindowStation
DrawIconEx
GetWindowDC
UnregisterClassW
EnumWindows
GetPropW
PostMessageW
GetWindowThreadProcessId
IsIconic
SetForegroundWindow
FindWindowW
BringWindowToTop
ShowWindow
GetActiveWindow
GetCapture
DestroyIcon
OffsetRect
CopyRect
GetDlgItem
SystemParametersInfoW
ReleaseDC
MonitorFromRect
IsWindowVisible
SetWindowRgn
InvalidateRect
SetWindowTextW
GetWindowTextW
GetClientRect
CreateCaret
HideCaret
ShowCaret
ClientToScreen
IsWindowEnabled
KillTimer
SetTimer
ReleaseCapture
MessageBoxW
SetCapture
GetDC
GetWindowRect
SendMessageW
SendNotifyMessageW
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
IsWindow
DestroyWindow
IsZoomed
SetWindowPos
MoveWindow
SetLayeredWindowAttributes
InflateRect
TrackMouseEvent
CharUpperW
MapVirtualKeyA
CharLowerBuffW
GetForegroundWindow
CallMsgFilterW
CheckMenuRadioItem
GetMenuContextHelpId
SetMenuContextHelpId
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
DeleteMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetSubMenu
CheckMenuItem
DestroyMenu
CreatePopupMenu
IsMenu
SetCaretPos
SystemParametersInfoA
DrawTextW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetSystemMetrics
GetSysColor
EnableMenuItem
SetRect
WaitMessage
PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DestroyCursor
GetDesktopWindow
SetActiveWindow
EnableWindow
GetIconInfo
CharNextW
WindowFromPoint
GetClassNameW
GetCursorPos
EndPaint
BeginPaint
UpdateWindow
AnimateWindow
ScreenToClient
LoadImageW
CreateIconFromResource
LoadBitmapW
PtInRect
EqualRect
IsRectEmpty
UnionRect
IntersectRect
SetCursor
GetKeyState
GetFocus
PostQuitMessage
GetMonitorInfoW
MonitorFromWindow
LoadCursorW
GetWindow
SetParent
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
UpdateLayeredWindow

gdi32

SetGraphicsMode
SelectObject
DeleteDC
CreateCompatibleDC
CreateBitmap
EnumFontsW
DeleteObject
RectInRegion
ExcludeClipRect
BitBlt
GetClipBox
GetDeviceCaps
RemoveFontMemResourceEx
ExtCreateRegion
IntersectClipRect
SelectClipRgn
SetWorldTransform
CreateDIBSection
GetCurrentObject
GetViewportOrgEx
CreateFontIndirectW
GetStockObject
Rectangle
SetBkMode
GetObjectW
StretchBlt
SetViewportOrgEx
SetTextColor
SetTextAlign
GetTextMetricsW
ExtTextOutW
GetTextFaceW
CreateSolidBrush
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
GdiFlush

advapi32

RegisterEventSourceW
ReportEventW
CryptGenRandom
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptSignHashW
CryptEnumProvidersW
CryptDestroyKey
CryptAcquireContextW
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
DeregisterEventSource
CryptReleaseContext
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegQueryValueExW

shell32

SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
ShellExecuteW

ole32

CreateBindCtx
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
IIDFromString
CoCreateGuid
CoInitialize
CoUninitialize
CoCreateInstance
RegisterDragDrop
OleLockRunning
CLSIDFromString
CoTaskMemFree

oleaut32

SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString

shlwapi

PathRemoveFileSpecW
PathRemoveBackslashW
PathCombineW
StrToIntExW
PathFileExistsW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wldap32

ord216
ord14
ord219
ord145
ord46
ord73
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext

imm32

ImmDestroyContext
ImmGetContext
ImmAssociateContext
ImmCreateContext
ImmReleaseContext

gdiplus

GdipBitmapLockBits
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipAlloc

ws2_32

recvfrom
getnameinfo
ntohl
gethostname
sendto
shutdown
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
socket
WSAStartup
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSACleanup
accept
htonl
listen
ioctlsocket

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 37B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15.1MB - Virtual size: 15.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aeb60504157277657640c64c52d0c67b

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:5d:45:23:54:52:ea:9e:e9:0c:37:04:98:8e:02:8eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

77:af:71:f8:0b:4a:04:21:b0:d2:e2:14:12:00:71:76:9e:29:13:99:b7:44:ac:7e:c8:e7:c1:2b:45:1e:b3:34Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wldap32

crypt32

imm32

gdiplus

ws2_32

usp10

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 92KB - Virtual size: 195KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 37B

.rsrc Size: 15.1MB - Virtual size: 15.1MB

.reloc Size: 231KB - Virtual size: 230KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:5d:45:23:54:52:ea:9e:e9:0c:37:04:98:8e:02:8e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

77:af:71:f8:0b:4a:04:21:b0:d2:e2:14:12:00:71:76:9e:29:13:99:b7:44:ac:7e:c8:e7:c1:2b:45:1e:b3:34
Signer

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 92KB - Virtual size: 195KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 37B

.rsrc
Size: 15.1MB - Virtual size: 15.1MB

.reloc
Size: 231KB - Virtual size: 230KB