Monday, May 20, 2024

Magniber Ransomware Using Signed APPX Files To Infect Systems

The Magniber ransomware has been spotted using Windows application package files (.APPX) signed with valid certificates to drop malware pretending to be Chrome and Edge web browser updates.

This distribution method marks a shift from previous approaches seen with this threat actor, which typically relies on exploiting Internet Explorer vulnerabilities.

Browser update notification

The infection begins by visiting a payload dropping website, researchers at Korea cybersecurity company AhnLab note in a report published today.

How victims get to the website, remains unclear. The lure could be delivered via phishing emails, links sent through IMs on social media, or other distribution methods.

Two of the URLs distributing the payload are “hxxp://b5305c364336bqd.bytesoh.cam”, and “hxxp://hadhill.quest/376s53290a9n2j”, but these may not be the only ones.

Visitors to these sites receive an alert to update their Edge/Chrome browser manually, and are offered an APPX file to complete the action.

edge alert
Alert to download the fake Edge update
Source: ASEC

APPX files are Windows application package files created for streamlined distribution and installation and have been abused by various threats in the past for malware distribution.

In the case of Magniber ransomware, the disguised APPX file is digitally signed with a valid certificate, so Windows sees them as trusted files that do not trigger a warning.

The threat actor’s choice to use APPX files is most likely driven by the need to reach a wider audience since the market share for Internet Explorer is dwindling into extinction.

Dropping the payload

Accepting the malicious APPX file results in creating two files on the “C:\Program Files\WindowsApps” directory, namely the ‘wjoiyyxzllm.exe’ and the ‘wjoiyyxzllm.dll’.

dll payload
DLL code part responsible for downloading and decoding the payload
Source: ASEC

These files execute a function that fetches the Magniber ransomware payload, decodes it, and then executes it.

Recommended:  500,000+ Android Users Downloaded a New Joker Malware App from Play Store

After encrypting the data on the system, the threat creates the following ransom note:

ransomware note
Magniber ransom note dropped onto encrypted systems
Source: ASEC

Although the note is in English, it is worth noting that Magniber ransomware targets Asian users exclusively these days.

At the moment there is no possibility to decrypt files locked by this malware free of charge.

Unlike most ransomware operations, Magniber did not adopt the double extortion tactic, so it does not steal files before encrypting the systems.

Backing up the data on a regular basis is a good solution to recover from attacks with low-tier ransomware like Magniber.

Go to home page

Go to Cybersecurity News

Bookmark
ClosePlease login
Share the word, let's increase Cybersecurity Awareness as we know it
- Sponsored -

Sponsored Offer

Unleash the Power of the Cloud: Grab $200 Credit for 60 Days on DigitalOcean!

Digital ocean free 200

Discover more infosec

User Avatar
Steven Black (n0tst3)
Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK. I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated... I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK. I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

more infosec reads

Subscribe for weekly updates

explore

more

security