2024-09-05_2855efb98519df3078678d8ed96365e1_magniber_revil_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2024-09-05_2855efb98519df3078678d8ed96365e1_magniber_revil_rhadamanthys
Size 70.4MB
Sample240905-lhkxjaybph
SHA256 05073d3f8f92fdf1064d69dc0ade649099b6f23732f4241ede68541418c3a5a8
MD5 2855efb98519df3078678d8ed96365e1
SHA1 b5d387a8445502781cf966b7b8fe97afb2206308
SHA512 bc329d4bef86f990e0cfc5da6c859393fce6175703c0f17cdc4b862668f1e2d4583da386b3204b92dd8c596237bdb9a62180dd51274ce8faa92f4d0b39e4720e
SSDEEP 1572864:LoxuVkox/ETpYcqn1GRa6CzAYhYbinNSMpZ5KcR8UqCIayPlDo:sMpova
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-05_2855efb98519df3078678d8ed96365e1_magniber_revil_rhadamanthys

File Explorer

2024-09-05_2855efb98519df3078678d8ed96365e1_magniber_revil_rhadamanthys

.exe 70.4MB

2024-09-05_2855efb98519df3078678d8ed96365e1_magniber_revil_rhadamanthys

IMPHASH c5ec8833ae2375045f5aea3d135fdae2
SHA256 05073d3f8f92fdf1064d69dc0ade649099b6f23732f4241ede68541418c3a5a8
MD5 2855efb98519df3078678d8ed96365e1
SHA1 b5d387a8445502781cf966b7b8fe97afb2206308
SHA512 bc329d4bef86f990e0cfc5da6c859393fce6175703c0f17cdc4b862668f1e2d4583da386b3204b92dd8c596237bdb9a62180dd51274ce8faa92f4d0b39e4720e
SSDEEP 1572864:LoxuVkox/ETpYcqn1GRa6CzAYhYbinNSMpZ5KcR8UqCIayPlDo:sMpova
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50476592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer.pdb

kernel32

LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA EnterCriticalSection LeaveCriticalSection GetLastError InitializeCriticalSectionEx GetModuleFileNameW DeleteCriticalSection SetLastError GetCurrentThreadId RaiseException WideCharToMultiByte LocalFree FormatMessageW FormatMessageA SetEvent CreateEventW CreateMutexW ReleaseMutex CloseHandle CreateFileW WaitForMultipleObjects WaitForSingleObject PostQueuedCompletionStatus TerminateThread QueueUserAPC DecodePointer CreateEventA CreateDirectoryW GetCurrentProcess MoveFileExW GetTempPathW ExpandEnvironmentStringsW GetUserGeoID GetGeoInfoW GetLocaleInfoW GlobalMemoryStatusEx GetComputerNameW DeleteFileW MoveFileW GetSystemTimeAsFileTime GetUserDefaultLCID GetStringTypeExA LCMapStringA LoadLibraryA FreeLibrary GetQueuedCompletionStatus SetWaitableTimer SleepEx CreateIoCompletionPort InitializeCriticalSectionAndSpinCount CreateWaitableTimerW GetTempFileNameW GetTickCount GetStringTypeExW LCMapStringW UnregisterWaitEx RegisterWaitForSingleObject UnregisterWait CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent MulDiv HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetPrivateProfileStringW WritePrivateProfileStringW GlobalAlloc GlobalFree GlobalSize GlobalLock GlobalUnlock FindFirstFileW GetFileAttributesW FindClose VerifyVersionInfoW VerSetConditionMask IsWow64Process InitializeCriticalSection GetProcAddress GetCurrentProcessId ProcessIdToSessionId OpenProcess FindNextFileW WaitNamedPipeW WriteFile ReadFile ResumeThread CreateProcessW TerminateProcess K32GetModuleBaseNameW QueryFullProcessImageNameW K32GetModuleFileNameExW K32EnumProcesses GetProcessId GetExitCodeProcess GetSystemInfo GetCurrentThread SetThreadPriority GetCommandLineW SetErrorMode SetProcessShutdownParameters ReleaseSemaphore WaitForSingleObjectEx DuplicateHandle CreateSemaphoreA QueryPerformanceCounter QueryPerformanceFrequency lstrlenW GlobalReAlloc GetLocalTime GetTimeFormatW SizeofResource LockResource LoadResource FindResourceW FindResourceExW CopyFileW GetSystemDirectoryW LoadLibraryExW LoadLibraryW SetSearchPathMode SetDllDirectoryW HeapSetInformation SetProcessDEPPolicy MultiByteToWideChar GetSystemTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDateFormatW GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW Sleep GetProcessTimes SetPriorityClass GetPriorityClass GetVersionExW GetConsoleTitleW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive GetVersion TryAcquireSRWLockExclusive TryAcquireSRWLockShared TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS CreateSemaphoreW TlsAlloc TlsGetValue TlsSetValue TlsFree GetNativeSystemInfo GetFullPathNameW CompareStringW GetNumberFormatW GetCurrencyFormatW GetSystemDefaultLCID OutputDebugStringW GetTempPathA GetTempFileNameA GetCPInfo GetModuleHandleW LocalAlloc LocalSize DebugBreak GetFileSize SetEndOfFile SetFilePointer CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile SetHandleInformation SetFileCompletionNotificationModes TransactNamedPipe CancelIo SwitchToThread SetConsoleCtrlHandler GetFileType GetConsoleMode CreateFileA FlushFileBuffers ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW GetNamedPipeHandleStateW CancelSynchronousIo QueueUserWorkItem CreateNamedPipeA SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW WriteConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetDiskFreeSpaceW GetFileInformationByHandle GetFileSizeEx RemoveDirectoryW SetFilePointerEx SetFileTime DeviceIoControl ReOpenFile CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW GetStdHandle GetStartupInfoW CreateThread CompareFileTime VirtualAlloc VirtualProtect VirtualFree GetModuleHandleExW GetACP ReadConsoleA GetExitCodeThread K32EnumProcessModules GetSystemFirmwareTable OpenEventW OpenMutexW CreateFileMappingA OpenFileMappingA MapViewOfFileEx TzSpecificLocalTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemDefaultLangID lstrcmpW OutputDebugStringA lstrcmpiW InitOnceExecuteOnce GetTickCount64 VirtualQuery Module32FirstW Module32NextW GetThreadId CreatePipe InitializeProcThreadAttributeList UpdateProcThreadAttribute AreFileApisANSI HeapCreate LockFile GetFullPathNameA UnlockFileEx HeapValidate GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW GetVersionExA DeleteFileA HeapCompact UnlockFile LockFileEx GetDriveTypeW SetFileAttributesW GetLogicalDriveStringsW GetVolumeInformationW IsDebuggerPresent OpenThread GetComputerNameExA GetComputerNameExW SetUnhandledExceptionFilter GetDiskFreeSpaceExW WTSGetActiveConsoleSessionId GetEnvironmentVariableA GetPrivateProfileIntW GetPrivateProfileSectionW GetSystemDefaultUILanguage GetUserDefaultUILanguage LCIDToLocaleName GetThreadTimes GetDynamicTimeZoneInformation GetOverlappedResult AcquireSRWLockShared CancelIoEx EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent GetStringTypeW FindFirstFileExW SetFileInformationByHandle CreateDirectoryExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW LCMapStringEx CompareStringEx GetFileTime GetWindowsDirectoryW CopyFileExW WaitForMultipleObjectsEx OpenEventA CreateWaitableTimerA UnhandledExceptionFilter RtlUnwind ExitThread FreeLibraryAndExitThread SetStdHandle GetConsoleOutputCP ExitProcess IsValidLocale EnumSystemLocalesW IsValidCodePage GetOEMCP GetCommandLineA LocalFileTimeToFileTime GetSystemPowerStatus SetThreadExecutionState Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimes GetLogicalProcessorInformationEx

imm32

ImmNotifyIME ImmGetCompositionStringW ImmAssociateContextEx ImmReleaseContext ImmGetContext ImmIsIME ImmSetCandidateWindow

Name

.text

Size

53.0MB

Virtual Size

53.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

262KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.9MB

Virtual Size

10.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

659KB

Virtual Size

658KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=10, id=253, version=31823,

count=20, id=260, version=31823,

count=30, id=259, version=31823,

count=55, id=259, version=30795,

count=123, id=261, version=31823,

count=63, id=205, version=50522,

count=1, id=263, version=30795,

count=235, id=261, version=30795,

count=4, id=262, version=30795,

count=77, id=260, version=30795,

count=2, id=171, productName=VS2010 build 30319, version=30319,

count=7, id=257, version=30795,

count=2, id=259, version=31947,

count=1030, productName=Unmarked objects (old),

count=1407, id=260, version=31947,

count=714, id=261, version=31947,

count=1395, id=1, productName=Unmarked objects,

count=8743, id=265, version=31947,

count=1, id=255, version=31947,

count=1, id=151,

count=1, id=258, version=31947,