2024-09-06_aeaebc8cffa9107b578085fabe1e322f_magniber_revil_rhadamanthys

Sharing

Copy URL

Twitter E-mail

General

Target

2024-09-06_aeaebc8cffa9107b578085fabe1e322f_magniber_revil_rhadamanthys
Size

70.4MB
MD5

aeaebc8cffa9107b578085fabe1e322f
SHA1

2c8f6f856f95011e7e7b07750eaa1e62b0e2bccf
SHA256

dd2eb9d22643740f44a63da407921b8dc80f5c539995087825fc9c10e69d4de7
SHA512

6947290e93a277458ffc62c79d2458e3b7fcd782090052a0a9c1ac396ccc38fd48d2b208f979242229b3f894748a882aec43e06a55feba3d4bb3d1e098ee6147
SSDEEP

1572864:FoxuVkox/ETpYcqn1GRa6CzAYhYbinNSMpZ5KcR8UqCIayPlDI:uMpovG

Score

1^/10

Malware Config

Signatures

Files

2024-09-06_aeaebc8cffa9107b578085fabe1e322f_magniber_revil_rhadamanthys
.exe windows:6 windows x86 arch:x86

c5ec8833ae2375045f5aea3d135fdae2

Code Sign

04:5b:d7:bd:e9:5f:97:12
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09-10-2020 11:32

Not After

09-10-2021 11:32

Subject

CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:5b:d7:bd:e9:5f:97:12
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09-10-2020 11:32

Not After

09-10-2021 11:32

Subject

CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:36:fd:d2:09:57:89:36:b1:25:70:12:4c:ab:ae:ea:54:71:26:f8:cd:72:2f:fb:93:65:21:51:ff:7e:40:eb
Signer

Actual PE Digest

6e:36:fd:d2:09:57:89:36:b1:25:70:12:4c:ab:ae:ea:54:71:26:f8:cd:72:2f:fb:93:65:21:51:ff:7e:40:eb

Digest Algorithm

sha256

PE Digest Matches

false

82:72:b2:de:99:f8:92:3d:6d:84:e9:b3:c4:54:b0:47:2e:63:59:e2
Signer

Actual PE Digest

82:72:b2:de:99:f8:92:3d:6d:84:e9:b3:c4:54:b0:47:2e:63:59:e2

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer.pdb

Imports

kernel32

LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionEx
GetModuleFileNameW
DeleteCriticalSection
SetLastError
GetCurrentThreadId
RaiseException
WideCharToMultiByte
LocalFree
FormatMessageW
FormatMessageA
SetEvent
CreateEventW
CreateMutexW
ReleaseMutex
CloseHandle
CreateFileW
WaitForMultipleObjects
WaitForSingleObject
PostQueuedCompletionStatus
TerminateThread
QueueUserAPC
DecodePointer
CreateEventA
CreateDirectoryW
GetCurrentProcess
MoveFileExW
GetTempPathW
ExpandEnvironmentStringsW
GetUserGeoID
GetGeoInfoW
GetLocaleInfoW
GlobalMemoryStatusEx
GetComputerNameW
DeleteFileW
MoveFileW
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetStringTypeExA
LCMapStringA
LoadLibraryA
FreeLibrary
GetQueuedCompletionStatus
SetWaitableTimer
SleepEx
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
CreateWaitableTimerW
GetTempFileNameW
GetTickCount
GetStringTypeExW
LCMapStringW
UnregisterWaitEx
RegisterWaitForSingleObject
UnregisterWait
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ResetEvent
MulDiv
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalAlloc
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
FindFirstFileW
GetFileAttributesW
FindClose
VerifyVersionInfoW
VerSetConditionMask
IsWow64Process
InitializeCriticalSection
GetProcAddress
GetCurrentProcessId
ProcessIdToSessionId
OpenProcess
FindNextFileW
WaitNamedPipeW
WriteFile
ReadFile
ResumeThread
CreateProcessW
TerminateProcess
K32GetModuleBaseNameW
QueryFullProcessImageNameW
K32GetModuleFileNameExW
K32EnumProcesses
GetProcessId
GetExitCodeProcess
GetSystemInfo
GetCurrentThread
SetThreadPriority
GetCommandLineW
SetErrorMode
SetProcessShutdownParameters
ReleaseSemaphore
WaitForSingleObjectEx
DuplicateHandle
CreateSemaphoreA
QueryPerformanceCounter
QueryPerformanceFrequency
lstrlenW
GlobalReAlloc
GetLocalTime
GetTimeFormatW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CopyFileW
GetSystemDirectoryW
LoadLibraryExW
LoadLibraryW
SetSearchPathMode
SetDllDirectoryW
HeapSetInformation
SetProcessDEPPolicy
MultiByteToWideChar
GetSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetDateFormatW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentDirectoryW
Sleep
GetProcessTimes
SetPriorityClass
GetPriorityClass
GetVersionExW
GetConsoleTitleW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
GetVersion
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
CreateSemaphoreW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetNativeSystemInfo
GetFullPathNameW
CompareStringW
GetNumberFormatW
GetCurrencyFormatW
GetSystemDefaultLCID
OutputDebugStringW
GetTempPathA
GetTempFileNameA
GetCPInfo
GetModuleHandleW
LocalAlloc
LocalSize
DebugBreak
GetFileSize
SetEndOfFile
SetFilePointer
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
SetHandleInformation
SetFileCompletionNotificationModes
TransactNamedPipe
CancelIo
SwitchToThread
SetConsoleCtrlHandler
GetFileType
GetConsoleMode
CreateFileA
FlushFileBuffers
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
GetNamedPipeHandleStateW
CancelSynchronousIo
QueueUserWorkItem
CreateNamedPipeA
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
ReadConsoleW
WriteConsoleW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetDiskFreeSpaceW
GetFileInformationByHandle
GetFileSizeEx
RemoveDirectoryW
SetFilePointerEx
SetFileTime
DeviceIoControl
ReOpenFile
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLongPathNameW
GetShortPathNameW
ReadDirectoryChangesW
GetStdHandle
GetStartupInfoW
CreateThread
CompareFileTime
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleExW
GetACP
ReadConsoleA
GetExitCodeThread
K32EnumProcessModules
GetSystemFirmwareTable
OpenEventW
OpenMutexW
CreateFileMappingA
OpenFileMappingA
MapViewOfFileEx
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemDefaultLangID
lstrcmpW
OutputDebugStringA
lstrcmpiW
InitOnceExecuteOnce
GetTickCount64
VirtualQuery
Module32FirstW
Module32NextW
GetThreadId
CreatePipe
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
AreFileApisANSI
HeapCreate
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
GetVersionExA
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
GetDriveTypeW
SetFileAttributesW
GetLogicalDriveStringsW
GetVolumeInformationW
IsDebuggerPresent
OpenThread
GetComputerNameExA
GetComputerNameExW
SetUnhandledExceptionFilter
GetDiskFreeSpaceExW
WTSGetActiveConsoleSessionId
GetEnvironmentVariableA
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
LCIDToLocaleName
GetThreadTimes
GetDynamicTimeZoneInformation
GetOverlappedResult
AcquireSRWLockShared
CancelIoEx
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
GetStringTypeW
FindFirstFileExW
SetFileInformationByHandle
CreateDirectoryExW
GetLocaleInfoEx
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
LCMapStringEx
CompareStringEx
GetFileTime
GetWindowsDirectoryW
CopyFileExW
WaitForMultipleObjectsEx
OpenEventA
CreateWaitableTimerA
UnhandledExceptionFilter
RtlUnwind
ExitThread
FreeLibraryAndExitThread
SetStdHandle
GetConsoleOutputCP
ExitProcess
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetCommandLineA
LocalFileTimeToFileTime
GetSystemPowerStatus
SetThreadExecutionState
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
GetSystemTimes
GetLogicalProcessorInformationEx

imm32

ImmNotifyIME
ImmGetCompositionStringW
ImmAssociateContextEx
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmSetCandidateWindow

Sections

.text
Size: 53.0MB - Virtual size: 53.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

IPPCODE
Size: 262KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10.9MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.6MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CPADinfo
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 657KB - Virtual size: 657KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5ec8833ae2375045f5aea3d135fdae2

Code Sign

04:5b:d7:bd:e9:5f:97:12Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

04:5b:d7:bd:e9:5f:97:12Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

6e:36:fd:d2:09:57:89:36:b1:25:70:12:4c:ab:ae:ea:54:71:26:f8:cd:72:2f:fb:93:65:21:51:ff:7e:40:ebSigner

82:72:b2:de:99:f8:92:3d:6d:84:e9:b3:c4:54:b0:47:2e:63:59:e2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

imm32

Sections

.text Size: 53.0MB - Virtual size: 53.0MB

IPPCODE Size: 262KB - Virtual size: 264KB

.rdata Size: 10.9MB - Virtual size: 10.9MB

.data Size: 5.6MB - Virtual size: 8.6MB

.didat Size: 4KB - Virtual size: 4KB

.rodata Size: 2KB - Virtual size: 4KB

CPADinfo Size: 512B - Virtual size: 4KB

.rsrc Size: 657KB - Virtual size: 657KB

04:5b:d7:bd:e9:5f:97:12
Certificate

07
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

04:5b:d7:bd:e9:5f:97:12
Certificate

07
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

6e:36:fd:d2:09:57:89:36:b1:25:70:12:4c:ab:ae:ea:54:71:26:f8:cd:72:2f:fb:93:65:21:51:ff:7e:40:eb
Signer

82:72:b2:de:99:f8:92:3d:6d:84:e9:b3:c4:54:b0:47:2e:63:59:e2
Signer

.text
Size: 53.0MB - Virtual size: 53.0MB

IPPCODE
Size: 262KB - Virtual size: 264KB

.rdata
Size: 10.9MB - Virtual size: 10.9MB

.data
Size: 5.6MB - Virtual size: 8.6MB

.didat
Size: 4KB - Virtual size: 4KB

.rodata
Size: 2KB - Virtual size: 4KB

CPADinfo
Size: 512B - Virtual size: 4KB

.rsrc
Size: 657KB - Virtual size: 657KB