Categories: InfoSec News Trending

Magniber Ransomware Using Signed APPX Files To Infect Systems

Published by
RiSec.n0tst3

The Magniber ransomware has been spotted using Windows application package files (.APPX) signed with valid certificates to drop malware pretending to be Chrome and Edge web browser updates.

This distribution method marks a shift from previous approaches seen with this threat actor, which typically relies on exploiting Internet Explorer vulnerabilities.

Browser update notification

The infection begins by visiting a payload dropping website, researchers at Korea cybersecurity company AhnLab note in a report published today.

How victims get to the website, remains unclear. The lure could be delivered via phishing emails, links sent through IMs on social media, or other distribution methods.

Two of the URLs distributing the payload are “hxxp://b5305c364336bqd.bytesoh.cam”, and “hxxp://hadhill.quest/376s53290a9n2j”, but these may not be the only ones.

Visitors to these sites receive an alert to update their Edge/Chrome browser manually, and are offered an APPX file to complete the action.

Alert to download the fake Edge update
Source: ASEC

APPX files are Windows application package files created for streamlined distribution and installation and have been abused by various threats in the past for malware distribution.

In the case of Magniber ransomware, the disguised APPX file is digitally signed with a valid certificate, so Windows sees them as trusted files that do not trigger a warning.

The threat actor’s choice to use APPX files is most likely driven by the need to reach a wider audience since the market share for Internet Explorer is dwindling into extinction.

Dropping the payload

Accepting the malicious APPX file results in creating two files on the “C:\Program Files\WindowsApps” directory, namely the ‘wjoiyyxzllm.exe’ and the ‘wjoiyyxzllm.dll’.

DLL code part responsible for downloading and decoding the payload
Source: ASEC

These files execute a function that fetches the Magniber ransomware payload, decodes it, and then executes it.

After encrypting the data on the system, the threat creates the following ransom note:

Magniber ransom note dropped onto encrypted systems
Source: ASEC

Although the note is in English, it is worth noting that Magniber ransomware targets Asian users exclusively these days.

At the moment there is no possibility to decrypt files locked by this malware free of charge.

Unlike most ransomware operations, Magniber did not adopt the double extortion tactic, so it does not steal files before encrypting the systems.

Backing up the data on a regular basis is a good solution to recover from attacks with low-tier ransomware like Magniber.

Go to home page

Go to Cybersecurity News

Bookmark
Please login to bookmark Close
Social Comments Box
Connect
Share the word, let's increase Cybersecurity Awareness as we know it

This post was last modified on 15 January 2022 2:29 PM

RiSec.n0tst3

Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK. I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated... I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK. I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

Leave a Comment
Published by
RiSec.n0tst3
Tags: AhnLab APPX files cybersecurity infosec Internet Explorer vulnerabilities Korea cybersecurity company AhnLab ransomware signed appx Systems threat analysis threat detection vulnerabilities

Recent Posts

  • Data Breach News
  • InfoSec News

WH Smith Announces Cyber-Attack: Employee Data Stolen

British high street chain WH Smith has recently revealed that it was hit by a…

2 years ago
  • InfoSec News
  • World Affairs

Voice ID: How Secure is it Really?

As banks worldwide roll out Voice ID as a means of user authentication over the…

2 years ago
  • Cybersecurity Academy
  • InfoSec News

What distinguishes Application Security from API Security?

In the era of digital transformation, cybersecurity has become a major concern for businesses. When…

2 years ago
  • Cybersecurity Academy
  • InfoSec News

The Top 5 Cybersecurity threats facing Businesses Today

In today's digital age, cybersecurity threats have become a significant concern for businesses of all…

2 years ago
  • InfoSec News
  • World Affairs

Enterprise users infected by RIG Exploit Kit thanks to Internet Explorer

The RIG Exploit Kit is currently in the midst of its most productive phase, attempting…

2 years ago
  • Cybersecurity Academy

The Rise and Rise of AI

One of the most transformational technologies of our time, artificial intelligence (AI), has quickly come…

2 years ago