2024-11-24_e119c43446ac3fe96180d068a11c14d4_luca-stealer_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-11-24_e119c43446ac3fe96180d068a11c14d4_luca-stealer_magniber
Size 5.4MB
Sample241124-jp87la1kcs
SHA256 5a1b6ba30e0eb0dec7c40f0d39eeb12a73e678dc1b765704207a70157c9dc978
MD5 e119c43446ac3fe96180d068a11c14d4
SHA1 43a373c18d0c8c28c6a1d319f2265115414a42ec
SHA512 de968556b1a1eee31b19cd2965dd58dc2684af9e2fc04542473547c98b925dee03261615373f589f1582f07df784bdee93cd47e957b605273b78cd8695d3bfd9
SSDEEP 98304:O7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG4/QmvD/cTwY2h3lfQw:oM7pTXexZPGzURnBh6gG4F+W3i
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-11-24_e119c43446ac3fe96180d068a11c14d4_luca-stealer_magniber

File Explorer

2024-11-24_e119c43446ac3fe96180d068a11c14d4_luca-stealer_magniber

.exe 5.4MB

2024-11-24_e119c43446ac3fe96180d068a11c14d4_luca-stealer_magniber

IMPHASH 6fd96551a83b4bafde8d378b3aa33c9d
SHA256 5a1b6ba30e0eb0dec7c40f0d39eeb12a73e678dc1b765704207a70157c9dc978
MD5 e119c43446ac3fe96180d068a11c14d4
SHA1 43a373c18d0c8c28c6a1d319f2265115414a42ec
SHA512 de968556b1a1eee31b19cd2965dd58dc2684af9e2fc04542473547c98b925dee03261615373f589f1582f07df784bdee93cd47e957b605273b78cd8695d3bfd9
SSDEEP 98304:O7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG4/QmvD/cTwY2h3lfQw:oM7pTXexZPGzURnBh6gG4F+W3i
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2410103

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

F:\Office\Target\x86\ship\click2run\en-us\AdminBootstrapper.pdb

gdi32

GetTextExtentPoint32W CreateSolidBrush SetTextColor SetBkColor GetStockObject CreateFontW SelectObject GetTextMetricsW CreatePen SetDCPenColor DeleteObject SetDCBrushColor GetDeviceCaps Rectangle

oleaut32

VariantInit VariantClear SysFreeString SysAllocString

advapi32

RevertToSelf OpenServiceW CloseServiceHandle OpenSCManagerW AdjustTokenPrivileges RegDeleteValueA RegEnumValueA SetServiceObjectSecurity ChangeServiceConfigW ChangeServiceConfig2W CreateServiceW DeleteService EnumDependentServicesW ControlService StartServiceW QueryServiceConfigW RegSetKeySecurity RegCreateKeyExW RegCloseKey CryptReleaseContext CryptAcquireContextW EventWriteTransfer EventRegister EventUnregister RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority CryptDestroyHash CryptGetHashParam CryptCreateHash CryptHashData RegNotifyChangeKeyValue LookupPrivilegeValueW EventWrite OpenThreadToken GetLengthSid InitializeAcl AddAccessAllowedAce AllocateAndInitializeSid CopySid OpenProcessToken FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA CheckTokenMembership CreateWellKnownSid EqualSid QueryServiceStatusEx

kernel32

QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter GetProcessTimes GetCurrentThread GetThreadTimes CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW DeviceIoControl RemoveDirectoryW GetEnvironmentVariableW SetEndOfFile FindClose CreateFileW GetFileAttributesW SetFileAttributesW GetFileAttributesExW GetDiskFreeSpaceExW DeleteFileW CloseHandle GetCurrentDirectoryW GetProcAddress SetFilePointerEx MoveFileExW GetModuleHandleW CopyFileW AreFileApisANSI WideCharToMultiByte UnmapViewOfFile CreateFileMappingA MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LoadLibraryA LCMapStringW FreeLibrary LocalFree FormatMessageA GetTickCount64 GetCurrentThreadId TlsAlloc TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetModuleHandleExW K32GetProcessMemoryInfo GlobalMemoryStatusEx LeaveCriticalSection EnterCriticalSection RaiseException InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive VerSetConditionMask VerifyVersionInfoW OpenProcess GetCurrentProcessId TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource GetVersionExW GetStringTypeW GetCPInfoExW GetUserDefaultLocaleName IsValidCodePage SetLastError GetSystemTime SystemTimeToFileTime FileTimeToSystemTime SetErrorMode GetComputerNameW MulDiv FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW CreateEventW SetEvent WaitForSingleObject ReleaseSemaphore WaitForSingleObjectEx CreateEventExW FlsFree WaitForMultipleObjectsEx CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork GetModuleHandleA LoadLibraryW OutputDebugStringA RtlCaptureStackBackTrace QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList ReleaseMutex TzSpecificLocalTimeToSystemTime GetTempPathW GetLongPathNameW VirtualProtectEx GetSystemInfo ResetEvent GlobalFree GlobalAlloc ReadFile WriteFile GetFileSizeEx LockResource GetOverlappedResult FlushFileBuffers CancelIoEx FindFirstFileExW GetDriveTypeW MultiByteToWideChar SetFileInformationByHandle GetFileInformationByHandleEx GetTempFileNameW SignalObjectAndWait GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer GetTickCount IsProcessorFeaturePresent WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus IsDebuggerPresent WaitForMultipleObjects GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW CreateMutexW VirtualFree ExpandEnvironmentStringsW VirtualAlloc OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA LocalAlloc HeapAlloc GetProcessHeap HeapFree GetThreadLocale lstrcmpW ProcessIdToSessionId GetExitCodeThread GetCommandLineW GetPriorityClass GetExitCodeProcess K32EnumProcesses GetTimeZoneInformation IsValidLocale GetLocaleInfoEx LCIDToLocaleName GetLocaleInfoW ResolveLocaleName GetUserPreferredUILanguages GetACP LocaleNameToLCID GetSystemDefaultLCID LCMapStringEx EnumSystemLocalesEx GetSystemDefaultLocaleName GetUserGeoID GetProductInfo SwitchToThread ExitProcess HeapReAlloc HeapSize GetConsoleCP ReadConsoleW GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer DuplicateHandle OpenThread DeleteCriticalSection CompareStringEx GetLastError InitializeCriticalSectionEx GetCurrentProcess K32GetProcessImageFileNameW GetSystemPreferredUILanguages GetDateFormatW GetTimeFormatW DeleteTimerQueueTimer CreateTimerQueueTimer lstrcmpA FreeConsole WriteConsoleW GetStdHandle AllocConsole AttachConsole DecodePointer EnumSystemLocalesW SetStdHandle GetModuleFileNameW IsWow64Process GetFileType GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA VirtualQuery LoadLibraryExA FlsAlloc CreateThread GetLocalTime

ole32

CoTaskMemAlloc IIDFromString CLSIDFromString CoTaskMemFree CoCreateInstance CoSetProxyBlanket CoCreateFreeThreadedMarshaler StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx CreateStreamOnHGlobal CoRegisterInitializeSpy CoRevokeInitializeSpy

cabinet

ord13 ord14

wintrust

WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

setupapi

SetupIterateCabinetW

ws2_32

FreeAddrInfoW WSAStartup GetAddrInfoW

iphlpapi

CreateSortedAddressPairs FreeMibTable

gdiplus

GdipCloneBrush GdipFillRectangleI GdipCreateFromHDC GdipDeleteBrush GdipCreateSolidFill GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipDeleteGraphics GdipDrawImageRectRectI GdiplusStartup GdipDrawImageRectI GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipLoadImageFromStream GdipCreateBitmapFromScan0

rpcrt4

UuidToStringW RpcStringFreeW

Sharing

General

Malware Config

Signatures

File Explorer

2024-11-24_e119c43446ac3fe96180d068a11c14d4_luca-stealer_magniber

gdi32

oleaut32

advapi32

kernel32

ole32

cabinet

wintrust

setupapi

ws2_32

iphlpapi

gdiplus

rpcrt4

generic