2024-09-13_ffa0375856e3149e9b99c51e43250798_hijackloader_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-13_ffa0375856e3149e9b99c51e43250798_hijackloader_magniber_revil
Size

61.9MB
MD5

ffa0375856e3149e9b99c51e43250798
SHA1

d31d6b3b8d00abb975634828e3a4a9bc423f42ae
SHA256

cf81d665fe2c8e612967e8070aab5fea6f287a01138b3a7a44e629d8b4019bfd
SHA512

9b11a07c4f476a6687350dbcb71e2d331f894d8474798496fcb61dd01dd4f843ad209e5aa81560e80afedab9389b2bac711f5d9771e435f243e0e39d6c4e363f
SSDEEP

786432:sLw0m9KICZ6+ExrdCioWWHTCQsueDptct4r8zg8f9kkBimf2C/2G2Io5qsqdMoVq:n9W6n+WWzslVr8zgfkB+G2Iuqon4JrM

Score

1^/10

Malware Config

Signatures

Files

2024-09-13_ffa0375856e3149e9b99c51e43250798_hijackloader_magniber_revil
.exe windows:5 windows x86 arch:x86

f2d9e8e24991c40d3a4c8dac0c1f0036

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:25:cd:86:06:d0:ee:31:a7:8c:2d:40
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/09/2023, 07:18

Not After

21/11/2024, 02:47

Subject

SERIALNUMBER=91510100MAACMR9234,CN=四川征云网络科技有限公司,OU=研发部,O=四川征云网络科技有限公司,L=Chengdu,ST=Sichuan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13074368656e676475,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:93:25:08:59:d6:72:1e:96:fb:74:0e:44:48:9f:4a:3d:5a:5c:19:0c:6e:e7:1b:cf:1d:22:16:40:45:8d:27
Signer

Actual PE Digest

d9:93:25:08:59:d6:72:1e:96:fb:74:0e:44:48:9f:4a:3d:5a:5c:19:0c:6e:e7:1b:cf:1d:22:16:40:45:8d:27

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\code\yebaoinstall\outputzz\ZZInstall.pdb

Imports

ws2_32

setsockopt
ntohs
htons
socket
getsockname
getpeername
connect
bind
WSAGetLastError
closesocket
recv
WSASetLastError
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
shutdown
getnameinfo
getaddrinfo
freeaddrinfo
WSACleanup
recvfrom
sendto
ntohl
getsockopt
gethostbyname
select
WSAStringToAddressW
WSAStartup
inet_addr
send
WSAAddressToStringW
inet_ntoa
WSAIoctl
gethostname

kernel32

GetEnvironmentVariableW
DeviceIoControl
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
CreatePipe
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetCurrentThreadId
GetVersionExW
GetSystemDirectoryW
FreeResource
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
GetFileAttributesExW
Process32NextW
GetDiskFreeSpaceExW
LockResource
DeleteFileW
Process32FirstW
CloseHandle
SetEndOfFile
WriteConsoleW
GetFullPathNameA
GetCurrentDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
HeapSize
SetConsoleCtrlHandler
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetACP
GetModuleFileNameA
ExitProcess
HeapReAlloc
GetModuleHandleExW
ResumeThread
ExitThread
RtlUnwind
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
FormatMessageA
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
SetFilePointer
GetFileSize
SetFileAttributesW
SetFileTime
GlobalUnlock
GlobalLock
GlobalFree
CreateMutexW
IsBadReadPtr
GetModuleHandleA
LoadLibraryA
GetVersionExA
GetLocalTime
GetTickCount
MulDiv
GetFullPathNameW
SetLastError
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapDestroy
HeapCreate
FlushInstructionCache
MultiByteToWideChar
InterlockedIncrement
WideCharToMultiByte
OutputDebugStringW
InterlockedDecrement
OutputDebugStringA
GetProcessTimes
MoveFileW
GetSystemTime
GetTempFileNameW
CopyFileW
FreeLibrary
GetModuleHandleW
GlobalAlloc
LocalFree
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
IsDebuggerPresent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ConvertThreadToFiber
CreateEventW
QueryPerformanceFrequency
QueryPerformanceCounter
EncodePointer
GetStringTypeW
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
FormatMessageW
RaiseException
LoadLibraryW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
SetCurrentDirectoryW
CreateProcessW
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcess
FindNextFileW
HeapFree
FindFirstFileW
SizeofResource
ReadFile
GetCurrentProcessId
DeleteCriticalSection
MoveFileExW
GetProcAddress
GetStartupInfoW
CreateDirectoryW
RtlCaptureStackBackTrace
lstrlenA
WriteFile
ReadConsoleA
SetConsoleMode
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread

user32

DestroyCursor
InvertRect
FillRect
EqualRect
PostQuitMessage
EnableWindow
IsWindowEnabled
SetActiveWindow
GetDesktopWindow
CharNextW
DestroyIcon
GetIconInfo
TrackMouseEvent
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
GetDC
PtInRect
IsWindow
IsRectEmpty
OffsetRect
IntersectRect
InflateRect
SetFocus
DrawIconEx
UnionRect
EndPaint
InvalidateRect
SetWindowTextW
GetCursorPos
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
GetClassNameW
LoadBitmapW
CreateIconFromResource
LoadImageW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
EnableMenuItem
SetRect
KillTimer
SetTimer
SetCursor
GetKeyState
BeginPaint
GetFocus
CopyRect
GetMonitorInfoW
MonitorFromWindow
LoadCursorW
GetWindow
GetProcessWindowStation
GetUserObjectInformationW
GetSysColor
GetSystemMetrics
MessageBoxW
LoadIconW
GetWindowPlacement
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowRect
ReleaseDC
SetForegroundWindow
GetClientRect
EnumWindows
GetForegroundWindow
ShowWindow
UnregisterClassW
GetPropW
SetWindowPos
GetWindowThreadProcessId
SendMessageW
DestroyWindow
PostMessageW
GetActiveWindow
LoadStringA
LoadStringW
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
GetDlgItem
wsprintfW
MsgWaitForMultipleObjects
SetMenuContextHelpId
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
DeleteMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
CheckMenuItem
DestroyMenu
CreatePopupMenu
IsMenu
UpdateLayeredWindow
MapVirtualKeyA

gdi32

Arc
Ellipse
CreateEllipticRgnIndirect
BitBlt
EnumFontsW
DeleteObject
CreateRoundRectRgn
CreateBitmap
CreateCompatibleDC
DeleteDC
ExcludeClipRect
GetClipRgn
GetRgnBox
CreatePen
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
Pie
PtInRegion
RectInRegion
RestoreDC
RoundRect
SaveDC
ExtSelectClipRgn
SetRectRgn
SetROP2
SetTextColor
GetWorldTransform
SetWorldTransform
CreateDIBSection
ExtCreatePen
Polyline
GetCurrentObject
GetViewportOrgEx
CreatePatternBrush
CreateRectRgn
GetTextColor
CreateRectRgnIndirect
CombineRgn
SetViewportOrgEx
CreateCompatibleBitmap
StretchBlt
GetDCOrgEx
GetObjectW
SetBkMode
Rectangle
GetStockObject
GetClipBox
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
SelectObject

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptGenRandom
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegEnumValueW
RegOpenKeyW
OpenServiceW
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExW
RegEnumKeyExW
ControlService
DeleteService
RegCreateKeyExW
RegDeleteKeyW
OpenSCManagerW
CloseServiceHandle
RegQueryInfoKeyW
RegCloseKey
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptDeriveKey
CryptCreateHash
CryptDecrypt
CryptEncrypt
QueryServiceStatus
CryptAcquireContextW
CryptGetKeyParam
CryptDestroyKey
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
SHFileOperationW

ole32

CreateBindCtx
CLSIDFromProgID
CLSIDFromString
OleLockRunning
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoCreateGuid
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysStringLen
VariantClear
SysFreeString
GetErrorInfo
VariantInit
CreateErrorInfo
SetErrorInfo
VariantChangeType
SysAllocString

shlwapi

StrCmpW
StrRChrW
PathIsDirectoryW
StrToIntExW
PathRemoveFileSpecW
PathCanonicalizeW
PathFindFileNameW
PathRemoveExtensionW
PathFileExistsW

netapi32

Netbios
NetApiBufferFree
NetWkstaGetInfo

iphlpapi

GetAdaptersInfo
GetIpForwardTable

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetSetOptionW

imm32

ImmAssociateContext
ImmGetContext
ImmReleaseContext

winhttp

WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpAddRequestHeaders

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipAlloc
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree

msimg32

GradientFill
AlphaBlend

crypt32

CertGetCertificateContextProperty
CertFindCertificateInStore
CertOpenStore
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage

wldap32

ord73
ord216
ord14
ord46
ord219
ord208
ord301
ord147
ord133
ord79
ord142
ord145
ord41
ord167
ord127
ord27
ord117
ord26

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 876KB - Virtual size: 876KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57.5MB - Virtual size: 57.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2d9e8e24991c40d3a4c8dac0c1f0036

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

7b:25:cd:86:06:d0:ee:31:a7:8c:2d:40Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

d9:93:25:08:59:d6:72:1e:96:fb:74:0e:44:48:9f:4a:3d:5a:5c:19:0c:6e:e7:1b:cf:1d:22:16:40:45:8d:27Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

netapi32

iphlpapi

version

wininet

imm32

winhttp

gdiplus

msimg32

crypt32

wldap32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 876KB - Virtual size: 876KB

.data Size: 54KB - Virtual size: 147KB

.gfids Size: 6KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 57.5MB - Virtual size: 57.5MB

.reloc Size: 176KB - Virtual size: 176KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

7b:25:cd:86:06:d0:ee:31:a7:8c:2d:40
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d9:93:25:08:59:d6:72:1e:96:fb:74:0e:44:48:9f:4a:3d:5a:5c:19:0c:6e:e7:1b:cf:1d:22:16:40:45:8d:27
Signer

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 876KB - Virtual size: 876KB

.data
Size: 54KB - Virtual size: 147KB

.gfids
Size: 6KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 57.5MB - Virtual size: 57.5MB

.reloc
Size: 176KB - Virtual size: 176KB